topic Splunk DB Connect: is this possible to add/update data to DB from Search-Head (in SH cluster Env) in Getting Data In

Splunk DB Connect: is this possible to add/update data to DB from Search-Head (in SH cluster Env)

pargupta1234 — Mon, 17 Aug 2020 01:49:51 GMT

I am planning to use DB-connect in my workflow. Right now all our lookups lie on SH nodes.

I want to add/update processed data to DB from SH nodes (in a clustered env) . Is this possible to do so using dbxoutput command ?

NOTE :processed data is created from some intermediate lookups which lie on SH nodes

gcusello — Mon, 17 Aug 2020 07:57:50 GMT

yes it's possible using DB-Connect and giving the correct grants to the user.: you can run all the queries you want, also add/update quesries.

But put very much attention to this because it isn't a security best practice!

I usually avoid to give add/update grants to Splunk users.

Ciao.

Giuseppe