Hi @gcusello , Just to clarify.   I am not an admin,  so it's not possible for me to create a role , correct? Thanks ... View more

Hi @gcusello  If I am not an admin, Is it possible to do the following?   (refer to my main question) I want to allow ONLY my team within "App1" to have read and write access to "Test" dashboard. Thanks ... View more

Hi @gcusello  When you said it's possible to add new field into past data in a summary index, is it a new entry/insert or an update ?   In my example, Is it possible to update (not insert) "Phone" field in "test_1" past data (_time/timestamp is in the past) ? Do I need to have permission to perform an update to an index? I think I only can perform insert, but not delete or update Your sample query is moving new data to the new index "test_2", not to same  "test_1" past data  if you have these information in a lookup, way do you need to save it in the index? the main_index has a large set of data, it's very slow doing a lookup in dashboard, that's why i filtered necessary data and moved it to summary index Past:  index=main_index + csv data ===> index=summary report="test1" Now: I updated csv data with a phone field  index=main_index + csv data ===> index=summary report="test2" Can I update (not insert) only "phone" field from "test2" to "test1" with Past timestamp? OR Can I update (not insert) only "phone" field from "main index+CSV" to  "test1" with Past Timestamp? index=main_index + csv data (NEW) ===> index=summary report="test1" (PAST Timestamp) Thank you ... View more

Hi KVStore and CSV are considered internal, correct? Based on your experience which one is the fastest?   KVStore? Thanks ... View more

Hello, My CSV data is coming from DB which get pulled from DBXquery. DB ==> DBXquery ==> CSV Since CSV have size limitation, so I am thinking just to use the DB via DBXLookup Thanks ... View more

Hi, Can you rephrase your statement?  I am not clear "eventually populated using a connection with a DB" Did you mean this flow DBxquery ==> KVStore Or KVStore ==> DBxquery Thanks ... View more

Do you mean KVStore? Have you tried DBXlookup yourself?  How slow is it? Thanks ... View more

Hello, Do you have any other alternative if I want to move away from CSV? Thanks ... View more

Hi @bowesmana  Thanks a lot!!  You rock!!   I did make attempt on using evenstats, but then It didn't work because of  if condition didn't work.  It turns out I had to use a match command.    I appreciate your help. ... View more

Hi @isoutamo  So if I am using lookup editor, I don't need an intervention from the admin, including restarting or refreshing URL, correct? Thanks ... View more

Whenever I update/create collections.conf or transforms.conf file manually , should Splunk need to be restarted (by admin)? Same question if I use Lookup Editor app - should Splunk need to be restarted (by admin) after updating/creating collections.conf or transforms.conf? https://splunkbase.splunk.com/app/1724   I think once we have these answered, you have solved this post.   Thank you so much ... View more

Hi, Thanks for answering my questions. Since I can update transform.conf myself, I only need to an admin to create collections.conf, correct? Thanks again ... View more

Hello, Sorry I wasn't clear. I modified my questions a bit below I was referring Splunk UI as in the menu: Lookups >> Lookup definitions >> Add new My previous two questions specifically asked about a relationship between Splunk UI and transform.conf (not collection.conf) 1) Can I create KVStore lookup definition in Splunk UI without creating transform.conf file directly via command line? [Yes/No] 2) Will creating KVStore lookup definition in Splunk UI automatically update transform.conf file? [Yes/No] The reason I asked because I only have the ability to create lookup definition through Splunk UI Lookup menu (not lookup editor) and I was wondering if that would create transform.conf I appreciate your suggestion, here's my response to yours suggestion (although didn't answer my two questions) 1) maybe - but I don't have a way to test   2) PC is restrictive  3) not possible Thank you ... View more

Thanks for your suggestion. I read your the link you provided. So, I can't outputlookup data to KVStore without building KVcollection first, correct? Should I create transform.conf and collection.conf? I don't have admin right.   search data | outputlookup kv_store_lookup   https://docs.splunk.com/Documentation/Splunk/9.2.1/Knowledge/ConfigureKVstorelookups https://docs.splunk.com/Documentation/SplunkCloud/9.1.2312/SearchReference/Outputlookup ... View more

Hi, Thank you for your suggestion. When I use a scheduled report, and see the recent search, Splunk appends "| summaryindex" at the end of the search, not "collect" command.   So, I thought "collect" always refers to "manual" push versus "summary index" in a scheduled report.  My understanding you have 2 scheduled reports. Is the following accurate? 1)  roll forward existing data (from and to the same summary index - say index A)  2) push new data (from a different index to summary index - say from index X to index A) In my case, the data from DBXquery is always get re-write, so I only need the latest data, but I may use your method in the future. Thanks for this. Based on the link that you sent and the following post, it looks like I still need the CSV file. (See below it does inputlookup to CSV first, then outputlookup to KV) Is this correct?    My goal is to avoid having CSV file since there's a limit in size   https://community.splunk.com/t5/Getting-Data-In/How-to-transfer-existing-CSV-data-to-kvstore/m-p/144641 | inputlookup filename.csv | outputlookup lookup_name Thank you again. ... View more

Hi So far, I didn't see any missing data, so it's not causing a problem, except for the error message. I am not sure why Splunk has to throw the error message.  Thank you for your help. ... View more

Hi, I am not sure the purpose of roll forward existing index. How do I use "collect" to write data in a scheduled report?  My understanding collect is a manual push. I am looking for automatic update daily. Where does KV store lookup save the data?  How do I move the DBXquery to KV store?  Does it require "admin"? What do you think about the "append command" in the previous post? Thank you so much for your help. ... View more

Hi, What I meant by splitting the data is to split the number of rows. So, if my query has 200k rows, splitting into 2, it becomes 100k rows. Or @marnall suggested split into a smaller queries..  not sure if it's possible since I have a large query involving multiple DBs I don't know how to do this in a scheduled report and write it into the same summary index with the same _time setting.  Please suggest. Thanks ... View more

Hi, Thanks for your help. No I do not care the order. I am afraid if I split the data and re-combine them it will return duplicate/missing data as it doesn't have a unique identifier. Also I don't know how to split the data and keeping the same _time.  Please help answer this. Thanks How do I split my query from DBXquery (eg. 200k rows)and push it into a Summary Index at the same time? ... View more

Hello, Thank you again for your help. Just to clarify,  I cannot set _time to the exact time every time I query the data, , correct? So, I need to filter the data last update, if I want to get the most recent copy. I currently are using CSV as a lookup, but the limitation is the size like you mentioned. I am trying to replace CSV lookup by doing the following:   Please let me know what you think. https://community.splunk.com/t5/Splunk-Search/How-to-perform-lookup-from-index-search-with-dbxquery/m-p/650654 | index=vulnerability_index | table ip_address, vulnerability, score | append [| dbxquery query="select * from tableCompany"] | stats values(*) as * by ip_address ... View more