Splunk DB Connect - data formating

Acxon1 — Wed, 08 Jul 2020 08:31:28 GMT

Hey everyone!

Lately we had an unfortunate incident were most of our logs were deleted from splunk. Luckily we saved the same data at our PostgreSQL DB.

To restore those logs, I want to export the PostgreSQL data via Splunk DB Connect.

I've read about the app and it looks like it can solve most of my concerns. My main issue that I couldn't find solution for is data formating.

To make it backwards compatible to our logs format, I want to parse the db table rows by:

1. Sending the data to splunk as a json

2. Add some custom key:value pairs (that are based / can be calculated from the database row)

3. Not include specific table columns

4. Append metadata to the logs (already found that this point is possible)

Is there a way of achieving those wishes without working with raw SQL?

If not, can I see an example of raw SQL that generates the wanted splunk log?

Also, is there any other way of exporting & importing data from postgres to splunk that can solve this issue?

Thank you!

topic Splunk DB Connect - data formating in Getting Data In