topic Re: Can Universal forwarder, can forward the SQL Table data to splunk? in Getting Data In

Can Universal forwarder, can forward the SQL Table data to splunk?

mohanmk95 — Sun, 16 Jun 2019 05:43:14 GMT

I am trying to forward the SQL Data to Splunk by using Universal Forwarder...

Is it possible to get the data in Splunk without using to SQL DB Connect?
if universal forward can forward the data then please share the Configuration.

Please help me to sort this.....!

Re: Can Universal forwarder, can forward the SQL Table data to splunk?

richgalloway — Sun, 16 Jun 2019 12:35:04 GMT

The Universal Forwarder can monitor text files, but it cannot monitor SQL databases. Unless you have a third-party utility to export the SQL table to a text file, you'll need DB Connect. DB Connect requires a heavy forwarder.

Re: Can Universal forwarder, can forward the SQL Table data to splunk?

DavidHourani — Sun, 16 Jun 2019 13:22:47 GMT

Hi @mohanmk95,

Here are the answers to your questions :
1- Is it possible to get the data in Splunk without using to SQL DB Connect?
Yes, if you have scripts dumping your data into files and the configure a Universal Forwarder to read those files and forward the data to your indexers.
2- If universal forward can forward the data then please share the Configuration.
IF you opt for a file dump of your DB then configuration of the UF is pretty simple, it will just be a file monitoring configuration:
https://docs.splunk.com/Documentation/Splunk/latest/Data/Monitorfilesanddirectorieswithinputs.conf

I would advise you to go via a heavy forwarder and pull your DB data into Splunk, it's just easier to maintain, configure and manage.

Cheers,
David

Re: Can Universal forwarder, can forward the SQL Table data to splunk?

VatsalJagani — Sun, 16 Jun 2019 15:04:04 GMT

Agree with @richgalloway. Not possible without Splunk DB connect or any similar App.

Re: Can Universal forwarder, can forward the SQL Table data to splunk?

niketn — Sun, 16 Jun 2019 16:17:16 GMT

@mohanmk95 if there is any specific reason for not using SQL DB Connect, try creating scripted input.

A sample script for Microsoft SQL Server connection and data polling is present on Splunk Docs: https://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/ScriptExample

You can create something similar and wrap the same with Splunk Add on Builder

With Universal Forwarder you can only forward SQL performance logs.

Re: Can Universal forwarder, can forward the SQL Table data to splunk?

richgalloway — Sun, 16 Jun 2019 21:11:42 GMT

I didn't say it isn't possible. It is indeed possible (depends on the flavor SQL), but not with a Universal Forwarder.

Re: Can Universal forwarder, can forward the SQL Table data to splunk?

VatsalJagani — Mon, 17 Jun 2019 13:57:21 GMT

My bad, it's typo it is **without.