I have data coming from MemSQL. Everything is fine with indexing, but I thought would it be possible to store data without indexing.
If so, how that could be done? Suggestions?
No, it's not.. Splunk's licensing model is based off index volume per day. If you could onboard data without indexing it, then it would upend Splunk's licensing model
You can use DBconnect (which I assume you're already using to index the data) to write your queries inline, then simply output to a lookup or KV store (read from that with inputlookup).
| dbxquery query="SELECT list,of,desired,columns,here FROM tableName" connection="YourMemSQLConnectionName" maxrows=100
| outputlookup memSQLQuery.csv
| inputlookup memSQLQuery.csv