https://community.splunk.com/t5/Getting-Data-In/How-to-optimize-data-key-value-pairs-to-be-injected-into-Splunk/m-p/230695#M44911 <P>It's possible (and quite simple if you know how, a simple streamstats with coalesce should do) to have the data from an earlier event appear in the following events. If you want the easiest solution for your customers however, then send every value with every event. The tradeoff is more license usage.</P> Tue, 10 Nov 2015 10:36:05 GMT jeffland 2015-11-10T10:36:05Z https://community.splunk.com/t5/Getting-Data-In/How-to-optimize-data-key-value-pairs-to-be-injected-into-Splunk/m-p/230694#M44910 <P>We are adding a new feature to our product to send data in key value pairs into Splunk using the new 6.3 Http Event Collector. <STRONG>We want our data in Splunk to be easily usable by customers as they build Splunk dashboards.</STRONG></P> <P>We have some values that change infrequently. Should we be sending the value that changes infrequently with each event we send to Splunk, or just when it actually changes? Or should we send that value only when it changes?</P> <PRE><CODE>2015-11-09 16:00:00.000 sentbytes=1000 receivedbytes=50 signalstrength=good 2015-11-09 16:00:05.000 sentbytes=10 receivedbytes=750 signalstrength=good 2015-11-09 16:00:10.000 sentbytes=109 receivedbytes=0 signalstrength=good 2015-11-09 16:00:15.000 sentbytes=244 receivedbytes=987 signalstrength=poor </CODE></PRE> <P>or </P> <PRE><CODE>2015-11-09 16:00:00.000 sentbytes=1000 receivedbytes=50 signalstrength=good 2015-11-09 16:00:05.000 sentbytes=10 receivedbytes=750 2015-11-09 16:00:10.000 sentbytes=109 receivedbytes=0 2015-11-09 16:00:15.000 sentbytes=244 receivedbytes=987 signalstrength=poor </CODE></PRE> Mon, 09 Nov 2015 23:31:05 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-optimize-data-key-value-pairs-to-be-injected-into-Splunk/m-p/230694#M44910 simpkins1958 2015-11-09T23:31:05Z https://community.splunk.com/t5/Getting-Data-In/How-to-optimize-data-key-value-pairs-to-be-injected-into-Splunk/m-p/230695#M44911 <P>It's possible (and quite simple if you know how, a simple streamstats with coalesce should do) to have the data from an earlier event appear in the following events. If you want the easiest solution for your customers however, then send every value with every event. The tradeoff is more license usage.</P> Tue, 10 Nov 2015 10:36:05 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-optimize-data-key-value-pairs-to-be-injected-into-Splunk/m-p/230695#M44911 jeffland 2015-11-10T10:36:05Z