Hi All,
I have inserted my raw data into Splunk. The data contains many records on sales statistics of different store branches. The data is in a format of "Date" "Branch_ID" "Sales in USD".
I would like to add new fields to each of these records.
For example, I would like to give score (based on a specific statistical algorithm of my choice) for each sales day, so the data should ideally look like "Date" "Branch_ID" "Sales in USD" "Score".
What should be the right approach to this issue?
On the one hand, I don't want to run the score function in real-time upon each search since it is quite heavy on performance. On the other hand, I would prefer not to duplicate all my data due to this enrichment.
As I understand, it is not possible to update fields on existing records. Is it true? Is the best thing to do is to run the score function and use the "collect" command to re-index the new records?
Thanks,
Ori.
