Splunk Enterprise

KVStore data retrieval performance issues


Hi All,

I have KV store with 1.5 million records(which isn't much for a kvstore) , have about 20 fields.

I am experiencing performance issues in terms of retrieving data from the KVstore, like if i just run a basic query to lookup a record using _key it is taking about 120 seconds to give me back the result.

In some of my saved searches i am using subsearch where i pull up the latest update timestamp from kvsotre, this subsearch is getting finalized as it is not able to complete execution in 60 seconds. Error message is "The search auto-finalized after it reached its time limit: 60 seconds."

I tried limiting the number of rows using updated timestamp but that is not helping either nor do top or head commands are helping.

I have tried accelerating the fields that are used in my saved searches but that did not help.

Question that i have for the group is, what are my options to expedite the data retrieval from the kvstore?

I know kvstore uses mongo db behind the scenes, hoping if some one already have used some of mongo db ways to expedite or any other solution that can be applied.

Truncating the data from the kvstore is not an option. 

Note _key is alphanumeric value.

Looking forward to your inputs.

Thank you in advance.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...