Monitoring Splunk

Temporary Memory



Is there an easy way to have a "temporary memory" that stores some variables when a query runs, and after each run it updates these variables so we can present these to the end users?

An example might be the total number of users per month, and the total number of users per year. Instead of searching for users per month, we can check these "temporary" variables to update the total count, which would save a lot of resoures and load time on the end user.

Any help is appreciated.

0 Karma



There are few possible ways for this and mostly used are
1. loookup where you are updating a lookup table on each search and use it later whenever you need.
2. Summary Indexing where you index daily/monthly data which are required and use it later.

Please have a look at the hyperlinks for information. Happy to assist further in case of questions on any of these.

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...

Starting With Observability: OpenTelemetry Best Practices

Tech Talk Starting With Observability: OpenTelemetry Best Practices Tuesday, October 17, 2023   |  11AM PST / ...