Search heads might slow down or crash if you exceed the storage capacity for KV Stores. Based on Splunk service limits, each KV Store collection can have a maximum size of 25 GB, and an entire KV Store can have a maximum size of 100 GB. See Service limits and constraints. Following are some tips to avoid exceeding the size limitations for KV Store collections:

• Do not write an excessive amount of data to your KV Store collections using scheduled saved searches.
• Do not retain an excessive amount of old data in your KV Store collections.

Follow these steps if your search heads crash or slow down due to large KV Store collections:

• Identify KV Store collections that exceed size limitations
• Identify data sources that write to KV Store collections
• Deactivate / Turn off saved searches that use specific KV Store collections
• Delete data in a KV Store collection
• Manage large KV Stores such as Access Tracker
• Add a retention policy to KV Store collections
• Increase storage space for KV Store collections
• Customize growth monitoring for KV Store collections