Basic KV Store Question - Updating Thousands of Records at Once

[alferone]

Hello all, 

I have a requirement to list all of our assets and show the last time they appeared in the logs of many different tools.  I wanted to use KV store for this.  We would run a search against each tool's logs and then update it's "last seen" time in the KV store for the particular asset.

I've attempted this a few ways, but I can't see to get it going.  I have the KV Store built with one column of last_seen times for one tool. But I am lost on how to update last_seen times for other tools for existing entries in the KV Store.

Any guidance would be appreciated.  Thank you!

[alferone]

So just to be clear, this would not be a candidate for KV Store?

[alferone]

I was considering that initially.  Would the search be a little taxing to pull all of the different tools and times together?

[gcusello]

Hi @alferone ,

I don't think so, if you have a fixed frequency of data update.

I prefer a summary index for the reasons I listed in my before answer.

Ciao.

Giuseppe

[alferone]

I'll give it a shot.  Thank you for your help!

[gcusello]

Hi @alferone ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

[gcusello · Accepted solution]

Hi @alferone ,

why don't you use a summary index?

in this way you're sure to have the last updated version, you have also the previous versions and you don't have any limitation to the number of entries.

Ciao.

Giuseppe