Hi splunkers!
Need your advice again.
We have a db table with users registrations. Millions of entries. There's an option for a user to merge with another account if for some reason he created another one. Merge happens pretty often. But there's no earliest date of registration for merged users in original table. So we address to another table where this info is stored. Make lookup of it and then make kv_store lookup of original table taking in consideration merged accounts lookup.
This kvstore lookup is used to correctly segment users' purchases, logins by their registration date.
Rewriting of this kv_store lookup takes hours and sometimes it skips..
Now we want to create outside splunk separate db table with correct registration information and to use it queries.
And here's a question: which way is better to use in this case?
- Dbxlookup without need to update something in splunk
- kv-store lookup with its complete rewriting several times a day
- kv-store lookup updating it values through REST API ?
