Splunk Enterprise

KVStore data retrieval performance issues

newbie2tech
Communicator

Hi All,

I have KV store with 1.5 million records(which isn't much for a kvstore) , have about 20 fields.

I am experiencing performance issues in terms of retrieving data from the KVstore, like if i just run a basic query to lookup a record using _key it is taking about 120 seconds to give me back the result.

In some of my saved searches i am using subsearch where i pull up the latest update timestamp from kvsotre, this subsearch is getting finalized as it is not able to complete execution in 60 seconds. Error message is "The search auto-finalized after it reached its time limit: 60 seconds."

I tried limiting the number of rows using updated timestamp but that is not helping either nor do top or head commands are helping.

I have tried accelerating the fields that are used in my saved searches but that did not help.

Question that i have for the group is, what are my options to expedite the data retrieval from the kvstore?

I know kvstore uses mongo db behind the scenes, hoping if some one already have used some of mongo db ways to expedite or any other solution that can be applied.

Truncating the data from the kvstore is not an option. 

Note _key is alphanumeric value.

Looking forward to your inputs.

Thank you in advance.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...