Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

kvstore lookups from database.

$
0
0
Hi Please give me any feedback . ideas as to whether I am following the best action. I have a database table that is occasionally updated / add to. I would like to start using this information in searches as a lookup. What is the best action to take here? I had thought of running a search and outputting he data to a KVstore lookup I have tried this but as any record in the table could be updated I am not clear on how to use the Key_field / _key value to pick up the updates. I have also seen examples using a csv lookup and using joins to merge the old / new data then writing out a new file. Which method is best for picking up changes that may occur in any field from the database. The records do have a fixed identity field which may help. Anyone able to recommend best method with an example?

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>