If I understand your problem statement, its basically being able to decide whether to use CSV vs KV Stores. For more clarity, take a look at this Splunk Documentation: http://dev.splunk.com/view/SP-CAAAEY7
Index based approach: Questions that I faced during a similar dilemma was being able to retrieve latest scores from the index, one solution is to use |stats latest(field1) by field2 ,
But KV stores are the best approach in my personal opinion,
Normal Lookup: So you can create a lookup file (kv-store) and create a lookup definition in the settings>lookup>lookup definitions view. But that lookup is not being applied. You need to apply that lookup say, to a data model for example.
Automated lookup: Once you define a lookup, create a lookup definition and then define an automatic lookup in the settings>lookup>automatic lookups , it applied INSTANTLY to the data that splunk ingests. PS. While creating an automatic lookup, you actually specify to what it applies sourcetype or host or source allowing splunk to use that information and apply your lookup to the data when it is being ingested.
... View more