Knowledge Management

When to use KV Store vs Index?

wesleya
Explorer

I'm working on a TA that pulls new domains from an API once per day and stores them in a KV store. I use this KV store in searches to monitor network logs for any events with domains that match domains from the KV Store.

Would it make sense to use an index to store these domains instead of a KV Store? Why or why not? what are the benefits/drawbacks of each?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The pros and cons of KV Store over indexes are much the same as those for lookup files vs indexes. KV Store adds the benefit of being able to modify individual rows or cells without re-writing the entire lookup. There are issues with using KV Store in a SHC, however.

---
If this reply helps you, Karma would be appreciated.
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Thanks for the Memories: .conf26 Took Learning to New Heights

Thank you, Splunk Community, for making .conf26 in Denver one for the books. From packed Splunk University ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Splunk Auto Ingestion Parallel Pipeline Scaling

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...