Getting Data In

What is the impact of increasing indexed_kv_limit in limits.conf?

mufthmu
Path Finder

Hi,

Some of my data has 1000+ fields and I want to increase indexed_kv_limit value to 2000 from limits.conf .

I know it's a big increase since the default value is only 200. I want to know how this activity can impact my indexing or search performance?

Thanks!

Labels (1)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

I believe it'll cause additional disk usage (as more indexed fields will be stored in tsidx files) and slightly slower indexing rate (more fields to be extracted and stored). Searching would be faster if you're searching on those indexed field.

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...