Knowledge Management

How do I check my KV store size?

khusain_splunk
Splunk Employee
Splunk Employee

I have a search head cluster and one of my searches is consuming full memory, which is running only in KV store, not going to even an indexer. I'm just looking for a command to check the KV store size, because the same search is running fine in a different environment. I'm suspecting that there is an issue with huge KV store in this environment.

0 Karma

splunkreal
Motivator
| rest /services/server/introspection/kvstore/collectionstats
| mvexpand data
| spath input=data
| rex field=ns "(?<App>.*)\.(?<Collection>.*)"
| eval dbsize=round(size/1024/1024, 2)
| eval indexsize=round(totalIndexSize/1024/1024, 2)
| stats first(count) AS "Number of Objects" first(nindexes) AS Accelerations first(indexsize) AS "Acceleration Size (MB)" first(dbsize) AS "Collection Size (MB)" by App, Collection
* If this helps, please upvote or accept solution if it solved *

khusain_splunk
Splunk Employee
Splunk Employee

Hi,

We can try below command on Searchhead to check the kvstore size:

index="_introspection" sourcetype="kvstore" component=KVStoreCollectionStats
| spath "data.ns"
| dedup "data.ns"
| eventstats sum(data.size) as total
| head 1
| eval totalGB=total/1024/1024/1024
| table totalGB

0 Karma

spammenot66
Contributor

That query doesn't seem right. For us the data.ns appears to be a the KV Store Name so it wouldn't make sense to sum by data.ns

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...