https://community.splunk.com/t5/Splunk-Search/Basic-KV-Store-Question-Updating-Thousands-of-Records-at-Once/m-p/698775#M237258 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/262427">@alferone</a>&nbsp;,</P><P>why don't you use a summary index?</P><P>in this way you're sure to have the last updated version, you have also the previous versions and you don't have any limitation to the number of entries.</P><P>Ciao.</P><P>Giuseppe</P> Wed, 11 Sep 2024 12:56:40 GMT gcusello 2024-09-11T12:56:40Z https://community.splunk.com/t5/Splunk-Search/Basic-KV-Store-Question-Updating-Thousands-of-Records-at-Once/m-p/698771#M237256 <P>Hello all,&nbsp;</P><P>I have a requirement to list all of our assets and show the last time they appeared in the logs of many different tools.&nbsp; I wanted to use KV store for this.&nbsp; We would run a search against each tool's logs and then update it's "last seen" time in the KV store for the particular asset.<BR /><BR />I've attempted this a few ways, but I can't see to get it going.&nbsp; I have the KV Store built with one column of last_seen times for one tool. But I am lost on how to update last_seen times for other tools for existing entries in the KV Store.<BR /><BR />Any guidance would be appreciated.&nbsp; Thank you!</P> Wed, 11 Sep 2024 12:28:41 GMT https://community.splunk.com/t5/Splunk-Search/Basic-KV-Store-Question-Updating-Thousands-of-Records-at-Once/m-p/698771#M237256 alferone 2024-09-11T12:28:41Z https://community.splunk.com/t5/Splunk-Search/Basic-KV-Store-Question-Updating-Thousands-of-Records-at-Once/m-p/698775#M237258 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/262427">@alferone</a>&nbsp;,</P><P>why don't you use a summary index?</P><P>in this way you're sure to have the last updated version, you have also the previous versions and you don't have any limitation to the number of entries.</P><P>Ciao.</P><P>Giuseppe</P> Wed, 11 Sep 2024 12:56:40 GMT https://community.splunk.com/t5/Splunk-Search/Basic-KV-Store-Question-Updating-Thousands-of-Records-at-Once/m-p/698775#M237258 gcusello 2024-09-11T12:56:40Z https://community.splunk.com/t5/Splunk-Search/Basic-KV-Store-Question-Updating-Thousands-of-Records-at-Once/m-p/698777#M237260 <P>I was considering that initially.&nbsp; Would the search be a little taxing to pull all of the different tools and times together?</P> Wed, 11 Sep 2024 12:58:14 GMT https://community.splunk.com/t5/Splunk-Search/Basic-KV-Store-Question-Updating-Thousands-of-Records-at-Once/m-p/698777#M237260 alferone 2024-09-11T12:58:14Z https://community.splunk.com/t5/Splunk-Search/Basic-KV-Store-Question-Updating-Thousands-of-Records-at-Once/m-p/698780#M237262 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/262427">@alferone</a>&nbsp;,</P><P>I don't think so, if you have a fixed frequency of data update.</P><P>I prefer a summary index for the reasons I listed in my before answer.</P><P>Ciao.</P><P>Giuseppe</P> Wed, 11 Sep 2024 13:00:57 GMT https://community.splunk.com/t5/Splunk-Search/Basic-KV-Store-Question-Updating-Thousands-of-Records-at-Once/m-p/698780#M237262 gcusello 2024-09-11T13:00:57Z https://community.splunk.com/t5/Splunk-Search/Basic-KV-Store-Question-Updating-Thousands-of-Records-at-Once/m-p/698781#M237263 <P>I'll give it a shot.&nbsp; Thank you for your help!</P> Wed, 11 Sep 2024 13:03:17 GMT https://community.splunk.com/t5/Splunk-Search/Basic-KV-Store-Question-Updating-Thousands-of-Records-at-Once/m-p/698781#M237263 alferone 2024-09-11T13:03:17Z https://community.splunk.com/t5/Splunk-Search/Basic-KV-Store-Question-Updating-Thousands-of-Records-at-Once/m-p/698912#M237292 <P>So just to be clear, this would not be a candidate for KV Store?</P> Thu, 12 Sep 2024 14:10:54 GMT https://community.splunk.com/t5/Splunk-Search/Basic-KV-Store-Question-Updating-Thousands-of-Records-at-Once/m-p/698912#M237292 alferone 2024-09-12T14:10:54Z https://community.splunk.com/t5/Splunk-Search/Basic-KV-Store-Question-Updating-Thousands-of-Records-at-Once/m-p/699193#M237382 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/262427">@alferone</a>&nbsp;,</P><P>good for you, see next time!</P><P>Ciao and happy splunking</P><P>Giuseppe</P><P>P.S.: Karma Points are appreciated <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Mon, 16 Sep 2024 15:03:31 GMT https://community.splunk.com/t5/Splunk-Search/Basic-KV-Store-Question-Updating-Thousands-of-Records-at-Once/m-p/699193#M237382 gcusello 2024-09-16T15:03:31Z