Knowledge Management

How do I check my KV store size?

khusain_splunk
Splunk Employee
Splunk Employee

I have a search head cluster and one of my searches is consuming full memory, which is running only in KV store, not going to even an indexer. I'm just looking for a command to check the KV store size, because the same search is running fine in a different environment. I'm suspecting that there is an issue with huge KV store in this environment.

0 Karma

splunkreal
Motivator
| rest /services/server/introspection/kvstore/collectionstats
| mvexpand data
| spath input=data
| rex field=ns "(?<App>.*)\.(?<Collection>.*)"
| eval dbsize=round(size/1024/1024, 2)
| eval indexsize=round(totalIndexSize/1024/1024, 2)
| stats first(count) AS "Number of Objects" first(nindexes) AS Accelerations first(indexsize) AS "Acceleration Size (MB)" first(dbsize) AS "Collection Size (MB)" by App, Collection
* If this helps, please upvote or accept solution if it solved *

khusain_splunk
Splunk Employee
Splunk Employee

Hi,

We can try below command on Searchhead to check the kvstore size:

index="_introspection" sourcetype="kvstore" component=KVStoreCollectionStats
| spath "data.ns"
| dedup "data.ns"
| eventstats sum(data.size) as total
| head 1
| eval totalGB=total/1024/1024/1024
| table totalGB

0 Karma

spammenot66
Contributor

That query doesn't seem right. For us the data.ns appears to be a the KV Store Name so it wouldn't make sense to sum by data.ns

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...