How do I check my KV store size?

[khusain_splunk]

I have a search head cluster and one of my searches is consuming full memory, which is running only in KV store, not going to even an indexer. I'm just looking for a command to check the KV store size, because the same search is running fine in a different environment. I'm suspecting that there is an issue with huge KV store in this environment.

[khusain_splunk]

Hi,

We can try below command on Searchhead to check the kvstore size:

index="_introspection" sourcetype="kvstore" component=KVStoreCollectionStats
| spath "data.ns"
| dedup "data.ns"
| eventstats sum(data.size) as total
| head 1
| eval totalGB=total/1024/1024/1024
| table totalGB

[spammenot66]

That query doesn't seem right. For us the data.ns appears to be a the KV Store Name so it wouldn't make sense to sum by data.ns