Monitoring Splunk

Temporary Memory

peterkn
Explorer

Hi,

Is there an easy way to have a "temporary memory" that stores some variables when a query runs, and after each run it updates these variables so we can present these to the end users?

An example might be the total number of users per month, and the total number of users per year. Instead of searching for users per month, we can check these "temporary" variables to update the total count, which would save a lot of resoures and load time on the end user.

Any help is appreciated.

0 Karma

renjith_nair
Legend

@peterkn,

There are few possible ways for this and mostly used are
1. loookup where you are updating a lookup table on each search and use it later whenever you need.
2. Summary Indexing where you index daily/monthly data which are required and use it later.

Please have a look at the hyperlinks for information. Happy to assist further in case of questions on any of these.

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...