How do I check my KV store size?

[khusain_splunk]

I have a search head cluster and one of my searches is consuming full memory, which is running only in KV store, not going to even an indexer. I'm just looking for a command to check the KV store size, because the same search is running fine in a different environment. I'm suspecting that there is an issue with huge KV store in this environment.

[splunkreal]

| rest /services/server/introspection/kvstore/collectionstats
| mvexpand data
| spath input=data
| rex field=ns "(?<App>.*)\.(?<Collection>.*)"
| eval dbsize=round(size/1024/1024, 2)
| eval indexsize=round(totalIndexSize/1024/1024, 2)
| stats first(count) AS "Number of Objects" first(nindexes) AS Accelerations first(indexsize) AS "Acceleration Size (MB)" first(dbsize) AS "Collection Size (MB)" by App, Collection

[khusain_splunk]

Hi,

We can try below command on Searchhead to check the kvstore size:

index="_introspection" sourcetype="kvstore" component=KVStoreCollectionStats
| spath "data.ns"
| dedup "data.ns"
| eventstats sum(data.size) as total
| head 1
| eval totalGB=total/1024/1024/1024
| table totalGB

[spammenot66]

That query doesn't seem right. For us the data.ns appears to be a the KV Store Name so it wouldn't make sense to sum by data.ns