Knowledge Management

kv_store vs dbxlookup


Hi splunkers!

Need your advice again.
We have a db table with users registrations. Millions of entries. There's an option for a user to merge with another account if for some reason he created another one. Merge happens pretty often. But there's no earliest date of registration for merged users in original table. So we address to another table where this info is stored. Make lookup of it and then make kv_store lookup of original table taking in consideration merged accounts lookup.

This kvstore lookup is used to correctly segment users' purchases, logins by their registration date.
Rewriting of this kv_store lookup takes hours and sometimes it skips..
Now we want to create outside splunk separate db table with correct registration information and to use it queries.

And here's a question: which way is better to use in this case?

  1. Dbxlookup without need to update something in splunk
  2. kv-store lookup with its complete rewriting several times a day
  3. kv-store lookup updating it values through REST API ?
Labels (1)
0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...