We are adding a new feature to our product to send data in key value pairs into Splunk using the new 6.3 Http Event Collector. We want our data in Splunk to be easily usable by customers as they build Splunk dashboards.
We have some values that change infrequently. Should we be sending the value that changes infrequently with each event we send to Splunk, or just when it actually changes? Or should we send that value only when it changes?
It's possible (and quite simple if you know how, a simple streamstats with coalesce should do) to have the data from an earlier event appear in the following events. If you want the easiest solution for your customers however, then send every value with every event. The tradeoff is more license usage.