Splunk Dev

delete some records from kvstore not working

sarit_s
Communicator

Hello
im trying to delete some records from my kvstore collection

when running this command (there are more keys i just didnt wanted it to be long) :

| inputlookup kv_alerts_prod 
| where ( ( _key="5f401a77cc0ddc039e76ade4" ) OR ( _key="5f401a77cc0ddc039e76ade5" ) OR ( _key="5f401a78cc0ddc039e76ade6" ) OR ( _key="5f401a78cc0ddc039e76ade7" ) OR ( _key="5f401a7bcc0ddc039e76ade8" ) OR ( _key="5f401a81cc0ddc039e76ade9" ) OR ( _key="5f401a84cc0ddc039e76adea" ) OR ( _key="5f401a84cc0ddc039e76adeb" ) OR ( _key="5f401a84cc0ddc039e76adec" ) OR ( _key="5f401a84cc0ddc039e76aded" ) OR ( _key="5f401a84cc0ddc039e76adee" ) OR ( _key="5f401a84cc0ddc039e76adef" ) OR ( _key="5f401a84cc0ddc039e76adf0" ) OR ( _key="5f401a84cc0ddc039e76adf1" ) OR ( _key="5f401a85cc0ddc039e76adf2" ) 
| outputlookup kv_alerts_prod

  im getting this error :

KV Store output failed with err: Request exceeds API limits - see limits.conf for details. (Batch save size=105742989 too large)

 

my limits.conf file looks like this :

[kvstore]
max_size_per_result_mb = 100000
max_size_per_batch_result_mb = 1000000000
max_size_per_batch_save_mb = 10000000000

 

what can i do ?

Labels (1)
0 Karma

Nisha18789
Builder

Hi @sarit_s , the key for the limit you are seeing is max_queries_per_batch , can you add this key in the kvstore stanza with a value greater than the value for which you are seeing the error and see it that fixes?

0 Karma

sarit_s
Communicator

Hello
thanks for your answer

 i added this and still getting the same error

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...