KVStorageProvider max_size_per_result_mb limit

[whitefang1726]

Hello Splunkers,

Good Day! I'm getting this error consistent. Out of confusion, those this mean it's the estimated KVStore size? max_size_per_result_mb value is current set by default (50 MB). 

KVStorageProvider [123456789 TcpChannelThread] - Result size too large, max_size_per_result_mb=52428800, Consider applying a skip and/or limit

Thanks!

[kiran_panchavat]

@whitefang1726 

The error does not indicate the total size of the KV Store. Instead, it means the data returned by a specific query is too large (exceeds 50 MB). Your query is likely retrieving too many records or large documents from the KV Store, exceeding the 50 MB limit per result set.

[kiran_panchavat]

@whitefang1726 

In the Splunk KV store, max_size_per_result_mb controls the maximum size of a result set (in MB) that can be returned from a single query to a collection.

Default Value:

The default value is 50 MB, but it's recommended to increase it if you need to retrieve larger results from the KV store

https://docs.splunk.com/Documentation/Splunk/latest/admin/Limitsconf 

max_size_per_result_mb = <unsigned integer>
* The maximum size, in megabytes (MB), of the result that will be
  returned for a single query to a collection.
* Default: 50