topic Re: Getting data splunked arriving over a network/database in Getting Data In

Getting data splunked arriving over a network/database

jigarkb — Fri, 11 Jan 2013 13:15:36 GMT

Here are some specific queries/problem statement I have :

How can data be directly fed into splunk in a programmatic manner? This would mean that there is no manual intervention. A scenario is that data is arriving over the network and it needs to be stored in splunk.
Is there a splunk connector which can directly talk to mysql database so that splunk can retrieve data automatically from mysql?
Can the splunk query response data be formatted in JSON? What other formats can splunk query response data be formatted in?

Re: Getting data splunked arriving over a network/database

Ayn — Fri, 11 Jan 2013 15:19:26 GMT

Yes. This is the most common way of feeding data into Splunk. Manually adding data is (I believe) less common. Filesystem-based inputs will continually monitor files or directories for new data and index it as soon as it arrives. Network-based inputs will do the same for network sockets.
Yes. Have a look at Splunk DB Connect.
Yes. JSON is one, CSV another, and there are more formats available, too. See information in the REST API docs:

Re: Getting data splunked arriving over a network/database

jigarkb — Wed, 16 Jan 2013 14:19:38 GMT

Can you explain in detail how to feed xml data coming over a network and feeding it into splunk?

Re: Getting data splunked arriving over a network/database

Ayn — Wed, 16 Jan 2013 21:16:20 GMT

No, that covers more than what I'd like to put in a simple answer. My suggestion is that you read the docs and become familiar with how Splunk works in a distributed environment.