topic Re: Ways to index MongoDB data in Splunk in All Apps and Add-ons

Ways to index MongoDB data in Splunk

JohannLiebert92 — Tue, 06 Feb 2018 06:24:29 GMT

Hi everyone,

I'm looking for ways to index data from MongoDB.

As per the post below, I'm aware of Hunk App for MongoDB and/or DB Connect,
https://answers.splunk.com/answers/553356/mongodb-data-indexing.html?utm_source=typeahead&utm_medium=newquestion&utm_campaign=no_votes_sort_relev

However, as I'm running Splunk 7.0.1, Hunk App for MongoDB doesn't seem to work in my case, I was unable to create virtual index (the New button is not visible). As for DB Connect, I'm aware of UnityJDBC which allows Splunk to connect to MongoDB but only during the trial, after which a license is required for full functionality. I would like to keep the purchase of the driver license as the last resort. May I know is there any alternatives to the above mentioned methods?

Any help would be much appreciated!

Re: Ways to index MongoDB data in Splunk

YoungN — Wed, 07 Feb 2018 16:38:39 GMT

For my MongoDB I created a REST Interface and created the access token. This allowed me to use the Rest-TA and pull the specific indexes from the MongoDB. It will come into Splunk as JSON and will parse out fairly easily to search through.

Re: Ways to index MongoDB data in Splunk

JohannLiebert92 — Tue, 20 Feb 2018 04:04:44 GMT

Hi nyoung,

Sorry for the delays.

Thanks for your suggestion! I'm quite new to MongoDB, may I know how is the effort like to create a REST interface and access token for MongoDB? Or if you have a link you could share that would be great.

Re: Ways to index MongoDB data in Splunk

YoungN — Tue, 20 Feb 2018 16:51:15 GMT

Sorry, I meant to go back and add a link for it.
easiest is to "npm install mongodb-rest" (https://www.npmjs.com/package/mongodb-rest)

Then here are some good step by step write up's for creating the rest instance in Node.js so you can pull down the different conditions. Check out the list of references with these three you should be able to figure most of it out to create your own.

References:
https://www.npmjs.com/package/mongodb-rest
https://getstream.io/blog/building-rest-api-node-js-restify-mongodb/
https://docs.mongodb.com/ecosystem/tools/http-interfaces/

Re: Ways to index MongoDB data in Splunk

JohannLiebert92 — Wed, 21 Feb 2018 02:24:05 GMT

Thanks! I will check those out