topic Is it possible to use SSH to connect Splunk to a MySQL database? in Getting Data In

Is it possible to use SSH to connect Splunk to a MySQL database?

rfagnoni — Wed, 14 Sep 2016 17:08:01 GMT

Hello,

I am trying to connect Splunk to a MySQL database, however MYSQL is only listening on localhost. To normally connect, I use an SSH connection first then open the connection to MySQL. Is this possible with Splunk?

Re: Is it possible to use SSH to connect Splunk to a MySQL database?

jagadeeshm — Thu, 15 Sep 2016 01:56:26 GMT

Are you using a MYSQL Connector or DBConnect? If yes, it requires exporting the database certificate and importing it into the trust store of the JVM powering the JavaBridge.

Re: Is it possible to use SSH to connect Splunk to a MySQL database?

dwaddle — Thu, 15 Sep 2016 02:55:34 GMT

Yes and no. Or no and yes...

Splunk (specifically the DB Connect app) cannot natively open an SSH connection and use that to transport the database connection.

BUT

SSH supports tunneling. If there is "something" that is continuously holding open an SSH connection with a defined tunnel, then it's possible you could get Splunk to use the tunnel to reach MySQL on the other system. Something like

while true; do ssh -L 13306:127.0.0.1:3306 user@mysqlserver 'while true; sleep 30; done'; done

This would in theory keep the SSH open indefinitely, enabling you to configure something on your Splunk system to use port 13306 to talk to port 3306 on the other side of the tunnel.

This type of thing is brittle by nature but it can be done.