Splunk Search

kvstore lookups from database.

dmcintosh1972
Explorer

Hi
Please give me any feedback . ideas as to whether I am following the best action.

I have a database table that is occasionally updated / add to. I would like to start using this information in searches as a lookup.

What is the best action to take here?

I had thought of running a search and outputting he data to a KVstore lookup I have tried this but as any record in the table could be updated I am not clear on how to use the Key_field / _key value to pick up the updates.

I have also seen examples using a csv lookup and using joins to merge the old / new data then writing out a new file.

Which method is best for picking up changes that may occur in any field from the database. The records do have a fixed identity field which may help.

Anyone able to recommend best method with an example?

0 Karma

codebuilder
Influencer

Use DB Connect. It can hook into your database, automatically generate lookup tables, and keep them updated.

https://splunkbase.splunk.com/app/2686/

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma
Get Updates on the Splunk Community!

Index This | What goes up and never comes down?

January 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Splunkers, Pack Your Bags: Why Cisco Live EMEA is Your Next Big Destination

The Power of Two: Splunk + Cisco at "Ludicrous Scale"   You know Splunk. You know Cisco. But have you seen ...

Data Management Digest – January 2026

Welcome to the January 2026 edition of Data Management Digest! Welcome to the January 2026 edition of Data ...