Knowledge Management

How do I check my KV store size?

khusain_splunk
Splunk Employee
Splunk Employee

I have a search head cluster and one of my searches is consuming full memory, which is running only in KV store, not going to even an indexer. I'm just looking for a command to check the KV store size, because the same search is running fine in a different environment. I'm suspecting that there is an issue with huge KV store in this environment.

0 Karma

splunkreal
Motivator
| rest /services/server/introspection/kvstore/collectionstats
| mvexpand data
| spath input=data
| rex field=ns "(?<App>.*)\.(?<Collection>.*)"
| eval dbsize=round(size/1024/1024, 2)
| eval indexsize=round(totalIndexSize/1024/1024, 2)
| stats first(count) AS "Number of Objects" first(nindexes) AS Accelerations first(indexsize) AS "Acceleration Size (MB)" first(dbsize) AS "Collection Size (MB)" by App, Collection
* If this helps, please upvote or accept solution 🙂 *

khusain_splunk
Splunk Employee
Splunk Employee

Hi,

We can try below command on Searchhead to check the kvstore size:

index="_introspection" sourcetype="kvstore" component=KVStoreCollectionStats
| spath "data.ns"
| dedup "data.ns"
| eventstats sum(data.size) as total
| head 1
| eval totalGB=total/1024/1024/1024
| table totalGB

0 Karma

spammenot66
Contributor

That query doesn't seem right. For us the data.ns appears to be a the KV Store Name so it wouldn't make sense to sum by data.ns

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...