topic Re: Can I run dbinput on demand instead of schedule? in All Apps and Add-ons

Can I run dbinput on demand instead of schedule?

santosh_sshanbh — Thu, 26 Apr 2018 14:08:52 GMT

I have a SH in Splunk cloud environment and HF and UF in local network. There are dbinputs configured on HF to run on a daily basis. Sometimes I want to fetch the realtime data from SQL server when a dashboard is opened. So is there any way by which I can trigger the dbinput from SH in cloud to pull the recent data from SQL server?

Re: Can I run dbinput on demand instead of schedule?

somesoni2 — Thu, 26 Apr 2018 18:13:06 GMT

You can run the same query you run as part of dbinput in dbxquery to see the realtime data (it won't be saved on the index but can be viewed on the dashboard. You can use collect command to actually save it to an index as well)

Re: Can I run dbinput on demand instead of schedule?

santosh_sshanbh — Fri, 27 Apr 2018 06:16:56 GMT

Thanks for your response. However, in my case the SH and Indexers are on Splunk cloud where as SQL database where UF is installed and HF where dbconnect app is installed are on local network behind firewall. HF is ending data to IX on Splunk cloud.

So how a dbxqury from cloud SH will get data from SQL server on local network?

Re: Can I run dbinput on demand instead of schedule?

ansif — Thu, 03 May 2018 09:36:25 GMT

Create a dbinput or clone existing one.Disable it.

Enable if it demands.

Re: Can I run dbinput on demand instead of schedule?

Richfez — Sat, 05 May 2018 12:16:22 GMT

I think @ansif's answer is the way to do this.

Create a clone of that db input (or just a new one that matches).

I believe a dbinput will only run when you enable it if it's set to a "number of seconds" schedule, so if yours is set to a cron or specific schedule (like "every day at midnight") change it to something like 1000.

Disable that input until you need it.

Then when you need an on demand run, just enable that db input, let it run, then disable it again.

Give that a try, and if it works for you, could you plase mark ansif's answer accepted?

Happy Splunking,
Rich