- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
When to use KV Store vs Index?
wesleya
Explorer
10-16-2019
08:53 AM
I'm working on a TA that pulls new domains from an API once per day and stores them in a KV store. I use this KV store in searches to monitor network logs for any events with domains that match domains from the KV Store.
Would it make sense to use an index to store these domains instead of a KV Store? Why or why not? what are the benefits/drawbacks of each?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

richgalloway

SplunkTrust
10-16-2019
09:45 AM
The pros and cons of KV Store over indexes are much the same as those for lookup files vs indexes. KV Store adds the benefit of being able to modify individual rows or cells without re-writing the entire lookup. There are issues with using KV Store in a SHC, however.
---
If this reply helps you, Karma would be appreciated.
If this reply helps you, Karma would be appreciated.
