Splunk Enterprise

KVStore data retrieval performance issues

newbie2tech
Communicator

Hi All,

I have KV store with 1.5 million records(which isn't much for a kvstore) , have about 20 fields.

I am experiencing performance issues in terms of retrieving data from the KVstore, like if i just run a basic query to lookup a record using _key it is taking about 120 seconds to give me back the result.

In some of my saved searches i am using subsearch where i pull up the latest update timestamp from kvsotre, this subsearch is getting finalized as it is not able to complete execution in 60 seconds. Error message is "The search auto-finalized after it reached its time limit: 60 seconds."

I tried limiting the number of rows using updated timestamp but that is not helping either nor do top or head commands are helping.

I have tried accelerating the fields that are used in my saved searches but that did not help.

Question that i have for the group is, what are my options to expedite the data retrieval from the kvstore?

I know kvstore uses mongo db behind the scenes, hoping if some one already have used some of mongo db ways to expedite or any other solution that can be applied.

Truncating the data from the kvstore is not an option. 

Note _key is alphanumeric value.

Looking forward to your inputs.

Thank you in advance.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...