Troubleshooting performance due to large KV stores
Search heads can crash or slow down if you exceed the storage capacity for KV Stores.
Based on Splunk service limits, each KV Store collection can have a maximum size of 25 GB, and an entire KV Store can have a maximum size of 100 GB. See Service limits and constraints.
Following are some tips to avoid exceeding the size limitations for KV Store collections:
- Do not retain an excessive amount of old data in your KV Store collections.
- Do not write an excessive amount of data to your KV Store collections using scheduled saved searches.
Follow these steps if your search heads crash or slow down due to large KV Store collections:
- Identify KV Store collections that exceed size limitations
- Identify data sources for large KV Store collections
- Turn off saved searches that use specific KV Store collections
- Delete data in a KV Store collection
- Manage large KV Store collections
- Add a retention policy to KV Store collections
- Increase storage space for KV Store collections