topic Re: How to export data from a Splunk to a database in All Apps and Add-ons

How to export data from a Splunk to a database

nalia_v — Fri, 03 Jul 2020 17:33:17 GMT

I am looking for ways to export data from a splanq to a database MS SQL.

I looked at the community but didn’t find anything how to export data from the splunk to any DB.

I found a way through DBconnect, but it doesn’t work because we have a distributed infrastructure splunk. through output.

We have DBconnect deployed on a heavy forwarder.

And indexes are not stored on it, they are stored on a separate server, so I can’t fulfill the request through output.

On SH we are not going to put one DBConnect.

Is there any other way to upload data from the splanck to the database MSSQL ?

Re: How to export data from a Splunk to a database

gcusello — Sat, 04 Jul 2020 05:30:44 GMT

Hi @nalia_v ,

if you want to export Splunk data to a DB using DB-Connect, you have to install it on a Search Head, in this way, DB-Connect can see all the data.

Otherwise, the only way is export data from Splunk in a file and import it.

Ciao.

Giuseppe

Re: How to export data from a Splunk to a database

isoutamo — Sat, 04 Jul 2020 06:05:44 GMT

as @gcusello said the normal way is to install it to SH too. Also I prefer to install it to MC, so I can do status monitoring and health checks. If those are out of questions then another option is use your HF as SH for DBConnect if it can query needed data from your indexers.

r. Ismo