topic Re: Use dashboard with SQL database in All Apps and Add-ons

Use dashboard with SQL database

MikeKulls — Thu, 20 Jun 2013 01:59:08 GMT

Is it possible to create a dashboard that gets all or some of its information from an SQL database? We find the dashboard to be an excellent tool but not all of our data is in Splunk.

Re: Use dashboard with SQL database

billford — Thu, 20 Jun 2013 02:05:09 GMT

Use dbconnect to get the data into Splunk and then dashboard it. Not sure you can do it directly but that's a really interesting feature request I think.

Re: Use dashboard with SQL database

MikeKulls — Thu, 20 Jun 2013 02:38:09 GMT

Getting the data into Splunk isn't really a good option. Using SQL directly in the dashboard would be the bee's knees of features imo. I would like to see a large number of employees go to Splunk first thing in the morning to get an overview of what is working and what isn't. But not everything is in Splunk so SQL access would make this a complete solution. I could even see some dashboards getting all of their information from SQL or sources outside Splunk.

Re: Use dashboard with SQL database

billford — Thu, 20 Jun 2013 02:41:28 GMT

Yeah I would agree that could be neat. What kind of data is it?

Re: Use dashboard with SQL database

MikeKulls — Thu, 20 Jun 2013 03:07:11 GMT

It's anything related a the workings of a large network. It could be performance data, alarms, fault reports, topology information

Re: Use dashboard with SQL database

billford — Thu, 20 Jun 2013 03:12:52 GMT

Well for what it's worth we do similar things with that sort of data and it works really well.

Re: Use dashboard with SQL database

MikeKulls — Thu, 20 Jun 2013 04:52:20 GMT

I guess putting all of that data into Splunk is an option but I'm a bit concerned with overusing Splunk. It's not a relational database and I don't want to use it for cases where I should be using a rdbms. We have an 18 month turnaround for Splunk data and if I store topology information in Splunk things could get messy. eg, if I write a log every time something changes but an element doesn't change for 18 months then data will be lost. Also, searching very old data in Splunk can be slow.

Re: Use dashboard with SQL database

billford — Thu, 20 Jun 2013 12:19:46 GMT

Yeah I can see your point. We treat things a little differently with our buckets.

Re: Use dashboard with SQL database

aelliott — Mon, 20 Jan 2014 16:52:30 GMT

You can run queries directly from sql using the following (db connect)
dbquery command

http://docs.splunk.com/Documentation/DBX/1.1.1/DeployDBX/Commands