topic Re: General question regarding indexing in Getting Data In

General question regarding indexing

vikas_gopal — Wed, 19 Feb 2014 14:54:57 GMT

Hi Guys,

Please help me to understand how indexing will work if we hit to an external database.For example if I prepare a dashboard from SQL database via "splunk db connect app" then how indexing works.

Regards
Vikas

Re: General question regarding indexing

richgalloway — Wed, 19 Feb 2014 15:18:36 GMT

It's not clear what your looking for. Anything DB Connect reads from a SQL database will be stored in the index specified in DB Connect. The indexing itself works the same as for any other data source.

Re: General question regarding indexing

vikas_gopal — Wed, 19 Feb 2014 15:28:08 GMT

Thanks Richgalloway,
Thanks for the clarity that indexing works the same for all the data sources. Actually I am not sure which index name specified at the time of DB connect .Is it possible to find out the index name ?

Why I am asking all these basic questions as i want to type a dbquery in Search bar .My dbquery is "| dbquery "databasename" "select date from abc" ".
I want to type it in search bar as
index=?? source=?? sourcetype=?? |fields date

Re: General question regarding indexing

richgalloway — Wed, 19 Feb 2014 15:33:47 GMT

To find the index name, go to Manager->Data Inputs->Database Inputs and you'll see the index for all defined database inputs. You'll also see the sourcetype names which you can put into your search query.

Re: General question regarding indexing

vikas_gopal — Wed, 19 Feb 2014 16:14:55 GMT

strange I have one database input and for that sourcetype is "None" and Splunk Index is "default" don't think so if solves my purpose....:(

Re: General question regarding indexing

richgalloway — Wed, 19 Feb 2014 16:20:50 GMT

So you can leave the index and sourcetype keywords out of your search since there are no values to use. You'll need to find other criteria to use to narrow your search.

Re: General question regarding indexing

vikas_gopal — Wed, 19 Feb 2014 16:38:39 GMT

even it is not working if I just mentioned | fields date in the search bar I mean how would splunk knows date field from which database and from which table without source or sourcetype ....Not sure if I am clear to you

Re: General question regarding indexing

richgalloway — Wed, 19 Feb 2014 19:37:39 GMT

You're right. Without a sourcetype, your SQL data would not be broken out into fields. See if you can change the definition of the DB Connect input to add a sourcetype. If that's not possible, you'll have to parse the _raw yourself using rex.