Getting Data In

What is the impact of increasing indexed_kv_limit in limits.conf?

mufthmu
Path Finder

Hi,

Some of my data has 1000+ fields and I want to increase indexed_kv_limit value to 2000 from limits.conf .

I know it's a big increase since the default value is only 200. I want to know how this activity can impact my indexing or search performance?

Thanks!

Labels (1)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

I believe it'll cause additional disk usage (as more indexed fields will be stored in tsidx files) and slightly slower indexing rate (more fields to be extracted and stored). Searching would be faster if you're searching on those indexed field.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...