Monitoring Splunk

Temporary Memory



Is there an easy way to have a "temporary memory" that stores some variables when a query runs, and after each run it updates these variables so we can present these to the end users?

An example might be the total number of users per month, and the total number of users per year. Instead of searching for users per month, we can check these "temporary" variables to update the total count, which would save a lot of resoures and load time on the end user.

Any help is appreciated.

0 Karma



There are few possible ways for this and mostly used are
1. loookup where you are updating a lookup table on each search and use it later whenever you need.
2. Summary Indexing where you index daily/monthly data which are required and use it later.

Please have a look at the hyperlinks for information. Happy to assist further in case of questions on any of these.

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...

What’s New in Splunk Cloud Platform 9.1.2308?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2308! Analysts can ...