Splunk Enterprise

KVStore data retrieval performance issues

newbie2tech
Communicator

Hi All,

I have KV store with 1.5 million records(which isn't much for a kvstore) , have about 20 fields.

I am experiencing performance issues in terms of retrieving data from the KVstore, like if i just run a basic query to lookup a record using _key it is taking about 120 seconds to give me back the result.

In some of my saved searches i am using subsearch where i pull up the latest update timestamp from kvsotre, this subsearch is getting finalized as it is not able to complete execution in 60 seconds. Error message is "The search auto-finalized after it reached its time limit: 60 seconds."

I tried limiting the number of rows using updated timestamp but that is not helping either nor do top or head commands are helping.

I have tried accelerating the fields that are used in my saved searches but that did not help.

Question that i have for the group is, what are my options to expedite the data retrieval from the kvstore?

I know kvstore uses mongo db behind the scenes, hoping if some one already have used some of mongo db ways to expedite or any other solution that can be applied.

Truncating the data from the kvstore is not an option. 

Note _key is alphanumeric value.

Looking forward to your inputs.

Thank you in advance.

0 Karma
Get Updates on the Splunk Community!

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...

Purpose in Action: How Splunk Is Helping Power an Inclusive Future for All

At Cisco, purpose isn’t a tagline—it’s a commitment. Cisco’s FY25 Purpose Report outlines how the company is ...

[Upcoming Webinar] Demo Day: Transforming IT Operations with Splunk

Join us for a live Demo Day at the Cisco Store on January 21st 10:00am - 11:00am PST In the fast-paced world ...