<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: When to use KV Store vs Index? in Knowledge Management</title>
    <link>https://community.splunk.com/t5/Knowledge-Management/When-to-use-KV-Store-vs-Index/m-p/461785#M4096</link>
    <description>&lt;P&gt;The pros and cons of KV Store over indexes are much the same as those for lookup files vs indexes.  KV Store adds the benefit of being able to modify individual rows or cells without re-writing the entire lookup.  There are issues with using KV Store in a SHC, however.&lt;/P&gt;</description>
    <pubDate>Wed, 16 Oct 2019 16:45:39 GMT</pubDate>
    <dc:creator>richgalloway</dc:creator>
    <dc:date>2019-10-16T16:45:39Z</dc:date>
    <item>
      <title>When to use KV Store vs Index?</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/When-to-use-KV-Store-vs-Index/m-p/461784#M4095</link>
      <description>&lt;P&gt;I'm working on a TA that pulls new domains from an API once per day and stores them in a KV store. I use this KV store in searches to monitor network logs for any events with domains that match domains from the KV Store. &lt;/P&gt;

&lt;P&gt;&lt;STRONG&gt;Would it make sense to use an index to store these domains instead of a KV Store? Why or why not? what are the benefits/drawbacks of each?&lt;/STRONG&gt;&lt;/P&gt;</description>
      <pubDate>Wed, 16 Oct 2019 15:53:11 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/When-to-use-KV-Store-vs-Index/m-p/461784#M4095</guid>
      <dc:creator>wesleya</dc:creator>
      <dc:date>2019-10-16T15:53:11Z</dc:date>
    </item>
    <item>
      <title>Re: When to use KV Store vs Index?</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/When-to-use-KV-Store-vs-Index/m-p/461785#M4096</link>
      <description>&lt;P&gt;The pros and cons of KV Store over indexes are much the same as those for lookup files vs indexes.  KV Store adds the benefit of being able to modify individual rows or cells without re-writing the entire lookup.  There are issues with using KV Store in a SHC, however.&lt;/P&gt;</description>
      <pubDate>Wed, 16 Oct 2019 16:45:39 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/When-to-use-KV-Store-vs-Index/m-p/461785#M4096</guid>
      <dc:creator>richgalloway</dc:creator>
      <dc:date>2019-10-16T16:45:39Z</dc:date>
    </item>
  </channel>
</rss>

