Splunk Dev

delete some records from kvstore not working

sarit_s
Communicator

Hello
im trying to delete some records from my kvstore collection

when running this command (there are more keys i just didnt wanted it to be long) :

| inputlookup kv_alerts_prod 
| where ( ( _key="5f401a77cc0ddc039e76ade4" ) OR ( _key="5f401a77cc0ddc039e76ade5" ) OR ( _key="5f401a78cc0ddc039e76ade6" ) OR ( _key="5f401a78cc0ddc039e76ade7" ) OR ( _key="5f401a7bcc0ddc039e76ade8" ) OR ( _key="5f401a81cc0ddc039e76ade9" ) OR ( _key="5f401a84cc0ddc039e76adea" ) OR ( _key="5f401a84cc0ddc039e76adeb" ) OR ( _key="5f401a84cc0ddc039e76adec" ) OR ( _key="5f401a84cc0ddc039e76aded" ) OR ( _key="5f401a84cc0ddc039e76adee" ) OR ( _key="5f401a84cc0ddc039e76adef" ) OR ( _key="5f401a84cc0ddc039e76adf0" ) OR ( _key="5f401a84cc0ddc039e76adf1" ) OR ( _key="5f401a85cc0ddc039e76adf2" ) 
| outputlookup kv_alerts_prod

  im getting this error :

KV Store output failed with err: Request exceeds API limits - see limits.conf for details. (Batch save size=105742989 too large)

 

my limits.conf file looks like this :

[kvstore]
max_size_per_result_mb = 100000
max_size_per_batch_result_mb = 1000000000
max_size_per_batch_save_mb = 10000000000

 

what can i do ?

Labels (1)
0 Karma

Nisha18789
Builder

Hi @sarit_s , the key for the limit you are seeing is max_queries_per_batch , can you add this key in the kvstore stanza with a value greater than the value for which you are seeing the error and see it that fixes?

0 Karma

sarit_s
Communicator

Hello
thanks for your answer

 i added this and still getting the same error

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...