Knowledge Management

kv_store vs dbxlookup


Hi splunkers!

Need your advice again.
We have a db table with users registrations. Millions of entries. There's an option for a user to merge with another account if for some reason he created another one. Merge happens pretty often. But there's no earliest date of registration for merged users in original table. So we address to another table where this info is stored. Make lookup of it and then make kv_store lookup of original table taking in consideration merged accounts lookup.

This kvstore lookup is used to correctly segment users' purchases, logins by their registration date.
Rewriting of this kv_store lookup takes hours and sometimes it skips..
Now we want to create outside splunk separate db table with correct registration information and to use it queries.

And here's a question: which way is better to use in this case?

  1. Dbxlookup without need to update something in splunk
  2. kv-store lookup with its complete rewriting several times a day
  3. kv-store lookup updating it values through REST API ?
Labels (1)
0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...