Identify data sources for large KV Store collections
If specific KV Store collections display memory errors, identify the saved searches that might be writing data to the KV Store collections. Turn off the scheduled saved searches that are not useful and remove unnecessary data from the KV Store collection. Alternatively, you can also modify the scheduled saved searches to reduce the frequency with which data is written to the KV Store collections. You can modify the searches by reducing the time range of the data, removing a data source, and decreasing the size or number of fields.
Identify saved searches that use specific KV Store collections
Following is an example SPL search to identify the saved searches that use a specific KV Store collection:
| rest "services/saved/searches" | search search="*<your_collection_name>*" | fields title, description, search, disabled
This SPL search checks whether the KV Store collection name appears in the search. You can also customize this search by checking for built-in and custom macros in the macros.conf file that uses the KV Store collection.