I would like to get my lookups (both CSV and KV Store) into an index, perhaps maybe once a day. This way I can view changes over view and would have an easy backup, not to mention it would be easier to search without needing to join on the inputlookup command.
Can anyone help me with an easy way to index my lookup data?
Then you schedule that to run daily as an alert or report. This won't count towards your license usage unless you set the sourcetype to anything other than the default "stash" on the collect statement.
If this comment/answer was helpful, please up vote it. Thank you.