https://community.splunk.com/t5/Knowledge-Management/KVSTORE-main-uses/m-p/472484#M4183 <P><STRONG>About KV Store collections</STRONG></P> <P>The KV Store stores your data as key-value pairs in collections. Here are the main concepts:</P> <P><STRONG>Collections</STRONG> : are the containers for your data, similar to a database table. Collections exist within the context of a given app.</P> <P><STRONG>Records</STRONG> contain each entry of your data, similar to a row in a database table.</P> <P><STRONG>Fields</STRONG> correspond to key names, similar to the columns in a database table. Fields contain the values of your data as a JavaScript Object Notation (JSON) document. Although not required, you can enforce data types (number, boolean, time, and string) for field values.</P> <P><STRONG>_key</STRONG> is a reserved field that contains the unique ID for each record. If you don't explicitly specify the _key value, the app auto-generates one.</P> <P><STRONG>_user</STRONG> is a reserved field that contains the user ID for each record. This field cannot be overridden.<BR /> Accelerations improve search performance by making searches that contain accelerated fields to return faster. Accelerations store a small portion of the collection's data set in an easy-to-traverse form.</P> <P><STRONG>What does it do?</STRONG><BR /> 1. The KV Store adds a new lookup type to use with your apps: "kvstore". Before the KV Store feature was added, you might have used CSV-based lookups to augment data within your apps.<BR /> 2. The KV Store is designed for large collections and is the easiest way to develop an application that uses key-value data.<BR /> 3. The KV Store is a good solution when data requires user interaction using the REST interface and when you have a frequently-changing data set.<BR /> 4. A CSV-based lookup is a good solution when the data set is small or changes infrequently, and when distributed search is required.</P> <P><STRONG>Advantages/Pros of KVstore:</STRONG></P> <UL> <LI>Enables per-record insert/updates ("upserts").</LI> <LI>Allows optional data type enforcement on write operations.</LI> <LI>It allows you to define field accelerations to improve search performance.</LI> <LI>Provides REST API access to the data collection.</LI> </UL> Thu, 31 Oct 2019 12:49:38 GMT dkolekar_splunk 2019-10-31T12:49:38Z https://community.splunk.com/t5/Knowledge-Management/KVSTORE-main-uses/m-p/472483#M4182 <P>collecting data works the same without kvstore installed? <BR /> what is the advantage to install it in an environment splunk? <BR /> what it does?</P> Thu, 31 Oct 2019 09:00:10 GMT https://community.splunk.com/t5/Knowledge-Management/KVSTORE-main-uses/m-p/472483#M4182 dani9 2019-10-31T09:00:10Z https://community.splunk.com/t5/Knowledge-Management/KVSTORE-main-uses/m-p/472484#M4183 <P><STRONG>About KV Store collections</STRONG></P> <P>The KV Store stores your data as key-value pairs in collections. Here are the main concepts:</P> <P><STRONG>Collections</STRONG> : are the containers for your data, similar to a database table. Collections exist within the context of a given app.</P> <P><STRONG>Records</STRONG> contain each entry of your data, similar to a row in a database table.</P> <P><STRONG>Fields</STRONG> correspond to key names, similar to the columns in a database table. Fields contain the values of your data as a JavaScript Object Notation (JSON) document. Although not required, you can enforce data types (number, boolean, time, and string) for field values.</P> <P><STRONG>_key</STRONG> is a reserved field that contains the unique ID for each record. If you don't explicitly specify the _key value, the app auto-generates one.</P> <P><STRONG>_user</STRONG> is a reserved field that contains the user ID for each record. This field cannot be overridden.<BR /> Accelerations improve search performance by making searches that contain accelerated fields to return faster. Accelerations store a small portion of the collection's data set in an easy-to-traverse form.</P> <P><STRONG>What does it do?</STRONG><BR /> 1. The KV Store adds a new lookup type to use with your apps: "kvstore". Before the KV Store feature was added, you might have used CSV-based lookups to augment data within your apps.<BR /> 2. The KV Store is designed for large collections and is the easiest way to develop an application that uses key-value data.<BR /> 3. The KV Store is a good solution when data requires user interaction using the REST interface and when you have a frequently-changing data set.<BR /> 4. A CSV-based lookup is a good solution when the data set is small or changes infrequently, and when distributed search is required.</P> <P><STRONG>Advantages/Pros of KVstore:</STRONG></P> <UL> <LI>Enables per-record insert/updates ("upserts").</LI> <LI>Allows optional data type enforcement on write operations.</LI> <LI>It allows you to define field accelerations to improve search performance.</LI> <LI>Provides REST API access to the data collection.</LI> </UL> Thu, 31 Oct 2019 12:49:38 GMT https://community.splunk.com/t5/Knowledge-Management/KVSTORE-main-uses/m-p/472484#M4183 dkolekar_splunk 2019-10-31T12:49:38Z https://community.splunk.com/t5/Knowledge-Management/KVSTORE-main-uses/m-p/472485#M4184 <P>How does kvstore manage concurrent updates to a single row and if it's undefined, is there any way to protect/lock against this?</P> Wed, 03 Jun 2020 04:01:21 GMT https://community.splunk.com/t5/Knowledge-Management/KVSTORE-main-uses/m-p/472485#M4184 bowesmana 2020-06-03T04:01:21Z