We would like to use Splunk to dashboard business level metrics. For these metrics, we would like to populate the "current day" information, and then update this metric (event) as the day continues. So the resulting metric would be something like: Date,Metric,Count 2013-08-20,Apples Sold,200 As the day progresses, we would like to update that count (300 apples, 400 apples, etc). Such that at the end of the day there is one event that contains the total number of apples for the day. While we can do incremental queries (count the number of apples sold since the last query) and then aggregate those metrics into a single number. In this case, it's far more efficient to simply have the database produce the number. With ElasticSearch we'd define the "key" to be the date and the metric. That way each time the same row is seen it would be updated. Is there a way to achieve a similar functionality in Splunk? ... View more