topic Re: how to get mongodb data index into splunk? in Getting Data In

how to get mongodb data index into splunk?

bestSplunker — Mon, 10 Jun 2019 08:13:21 GMT

I am trying to index mongodb data into splunk,

The Hunk App for MongoDB seems to be an obsolete. Is there a best way to import mongodb data into splunk? similar to the input function of db_connect? Because I don't just import it once, when mongodb has new data, I hope it can be automatically indexed to splunk

I refer to the following documentation, but when I connect to the mongodb database that requires authentication, it prompts an error.not authorized for query on xunfeng._schema. I am sure I have created an identity XunfengMongodb.

http://www.unityjdbc.com/mongojdbc/setup/mongodb_jdbc_splunk_dbconnect_v2.pdf

splunk version: 7.2.3
db connect version 3.1.3

Re: how to get mongodb data index into splunk?

Shan — Mon, 10 Jun 2019 09:07:46 GMT

Dear @bestSplunker,

have you tried the driver from the following post for DB Connect 3?
https://answers.splunk.com/answers/665976/mongodb-jdbc-driver-for-db-connect-312-not-working.html

Unsupported JDBC Drivers: https://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Installdatabasedrivers#Add_the_custom_database_to_db_connection_types.conf

ur own custom REST TA as called out in the following answer: https://answers.splunk.com/answers/616324/ways-to-index-mongodb-data-in-splunk.html

Thanks..

Re: how to get mongodb data index into splunk?

bestSplunker — Mon, 10 Jun 2019 09:56:20 GMT

thank you for your reply

I have download mongodb_unityjdbc_full.jar and copy the jar in the directory$SPLUNK_HOME/etc/apps/splunk_app_db_connect/drivers and add following data in the db_connection_types.conf file

[mongodb]
displayName = MongoDB
serviceClass = com.splunk.dbx2.DefaultDBX2JDBC
jdbcDriverClass = mongodb.jdbc.MongoDriver
jdbcUrlFormat = jdbc:mongo://host:port/database
port = 27017
ui_default_catalog = $database$

but is not working.

Customizing the API seems to be a complicated thing, and I don't want to spend too much time.

I believe DB connect 3 can connect to mongodb, and I suspect my JDBC URI configuration is error

Re: how to get mongodb data index into splunk?

bestSplunker — Wed, 10 Jul 2019 01:23:37 GMT

this issue has been solved. I used an old version of the driver. so .u need download new version of mongodb driver from http://unityjdbc.com/mongojdbc/mongo_jdbc.php

Re: how to get mongodb data index into splunk?

bestSplunker — Thu, 11 Jul 2019 08:03:12 GMT

this issue has been solved. I used an old version of the driver. so .u need download new version of mongodb driver from http://unityjdbc.com/mongojdbc/mongo_jdbc.php