topic Can you store data to Splunk without indexing? in Getting Data In

Can you store data to Splunk without indexing?

Anmar0293 — Tue, 08 Jan 2019 16:35:04 GMT

I have data coming from MemSQL. Everything is fine with indexing, but I thought would it be possible to store data without indexing.
If so, how that could be done? Suggestions?

Re: Can you store data to Splunk without indexing?

afurrowgtri — Tue, 08 Jan 2019 16:58:41 GMT

You can use DBconnect (which I assume you're already using to index the data) to write your queries inline, then simply output to a lookup or KV store (read from that with inputlookup).

https://docs.splunk.com/Documentation/DBX/3.1.3/DeployDBX/Commands

| dbxquery query="SELECT list,of,desired,columns,here FROM tableName" connection="YourMemSQLConnectionName" maxrows=100
| outputlookup memSQLQuery.csv

Then

| inputlookup memSQLQuery.csv

Re: Can you store data to Splunk without indexing?

skoelpin — Tue, 08 Jan 2019 17:02:13 GMT

No, it's not.. Splunk's licensing model is based off index volume per day. If you could onboard data without indexing it, then it would upend Splunk's licensing model