Monitoring Splunk

Temporary Memory

peterkn
Explorer

Hi,

Is there an easy way to have a "temporary memory" that stores some variables when a query runs, and after each run it updates these variables so we can present these to the end users?

An example might be the total number of users per month, and the total number of users per year. Instead of searching for users per month, we can check these "temporary" variables to update the total count, which would save a lot of resoures and load time on the end user.

Any help is appreciated.

0 Karma

renjith_nair
Legend

@peterkn,

There are few possible ways for this and mostly used are
1. loookup where you are updating a lookup table on each search and use it later whenever you need.
2. Summary Indexing where you index daily/monthly data which are required and use it later.

Please have a look at the hyperlinks for information. Happy to assist further in case of questions on any of these.

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...