Splunk Dev

delete some records from kvstore not working

sarit_s
Communicator

Hello
im trying to delete some records from my kvstore collection

when running this command (there are more keys i just didnt wanted it to be long) :

| inputlookup kv_alerts_prod 
| where ( ( _key="5f401a77cc0ddc039e76ade4" ) OR ( _key="5f401a77cc0ddc039e76ade5" ) OR ( _key="5f401a78cc0ddc039e76ade6" ) OR ( _key="5f401a78cc0ddc039e76ade7" ) OR ( _key="5f401a7bcc0ddc039e76ade8" ) OR ( _key="5f401a81cc0ddc039e76ade9" ) OR ( _key="5f401a84cc0ddc039e76adea" ) OR ( _key="5f401a84cc0ddc039e76adeb" ) OR ( _key="5f401a84cc0ddc039e76adec" ) OR ( _key="5f401a84cc0ddc039e76aded" ) OR ( _key="5f401a84cc0ddc039e76adee" ) OR ( _key="5f401a84cc0ddc039e76adef" ) OR ( _key="5f401a84cc0ddc039e76adf0" ) OR ( _key="5f401a84cc0ddc039e76adf1" ) OR ( _key="5f401a85cc0ddc039e76adf2" ) 
| outputlookup kv_alerts_prod

  im getting this error :

KV Store output failed with err: Request exceeds API limits - see limits.conf for details. (Batch save size=105742989 too large)

 

my limits.conf file looks like this :

[kvstore]
max_size_per_result_mb = 100000
max_size_per_batch_result_mb = 1000000000
max_size_per_batch_save_mb = 10000000000

 

what can i do ?

Labels (1)
0 Karma

Nisha18789
Builder

Hi @sarit_s , the key for the limit you are seeing is max_queries_per_batch , can you add this key in the kvstore stanza with a value greater than the value for which you are seeing the error and see it that fixes?

0 Karma

sarit_s
Communicator

Hello
thanks for your answer

 i added this and still getting the same error

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...