Monitoring Splunk

Temporary Memory

peterkn
Explorer

Hi,

Is there an easy way to have a "temporary memory" that stores some variables when a query runs, and after each run it updates these variables so we can present these to the end users?

An example might be the total number of users per month, and the total number of users per year. Instead of searching for users per month, we can check these "temporary" variables to update the total count, which would save a lot of resoures and load time on the end user.

Any help is appreciated.

0 Karma

renjith_nair
Legend

@peterkn,

There are few possible ways for this and mostly used are
1. loookup where you are updating a lookup table on each search and use it later whenever you need.
2. Summary Indexing where you index daily/monthly data which are required and use it later.

Please have a look at the hyperlinks for information. Happy to assist further in case of questions on any of these.

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

New Release | Splunk Cloud Platform 10.1.2507

Hello Splunk Community!We are thrilled to announce the General Availability of Splunk Cloud Platform 10.1.2507 ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...