Splunk Enterprise

KVStore data retrieval performance issues

newbie2tech
Communicator

Hi All,

I have KV store with 1.5 million records(which isn't much for a kvstore) , have about 20 fields.

I am experiencing performance issues in terms of retrieving data from the KVstore, like if i just run a basic query to lookup a record using _key it is taking about 120 seconds to give me back the result.

In some of my saved searches i am using subsearch where i pull up the latest update timestamp from kvsotre, this subsearch is getting finalized as it is not able to complete execution in 60 seconds. Error message is "The search auto-finalized after it reached its time limit: 60 seconds."

I tried limiting the number of rows using updated timestamp but that is not helping either nor do top or head commands are helping.

I have tried accelerating the fields that are used in my saved searches but that did not help.

Question that i have for the group is, what are my options to expedite the data retrieval from the kvstore?

I know kvstore uses mongo db behind the scenes, hoping if some one already have used some of mongo db ways to expedite or any other solution that can be applied.

Truncating the data from the kvstore is not an option. 

Note _key is alphanumeric value.

Looking forward to your inputs.

Thank you in advance.

0 Karma
Get Updates on the Splunk Community!

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to Officially Supported Splunk ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...