topic Re: Adding large number of databases to DB Connect in Knowledge Management

Adding large number of databases to DB Connect

theouhuios — Mon, 03 Feb 2014 15:32:36 GMT

Hello

Has anyone of you faced an issue where you had to add 300-500 DB Connections to DB Connect? If you did , did you use any easy method to solve it rather than adding each one of them manually? Please let me know if there is any better way to do it rather than adding it manually.

Update:

I am using the database.conf to do this as of now. But would like to know if there is a way to automate the part where splunk can update the conf file with all necessary parameters in case a new Database is being stood up. This can either be from a FAT file or from a DNS entry or by using a OID.

Re: Adding large number of databases to DB Connect

araitz — Thu, 06 Feb 2014 17:32:16 GMT

You could automate this via scripting calls to Splunk's REST API to create connections, but the details are far beyond the scope of what is possible via this answer.

Re: Adding large number of databases to DB Connect

theouhuios — Thu, 06 Feb 2014 18:23:37 GMT

Would you suggest making REST API calls based on OID ?

Re: Adding large number of databases to DB Connect

araitz — Thu, 06 Feb 2014 18:29:23 GMT

The Splunk REST API is pretty nuanced. In short, you make a GET request to /services/admin/databases/_new to get the required and optional fields. Then, to create a new database, you would POST to /services/admin/databases with the required and optional fields you want in the payload of the POST (aka postargs).

Note that this is just a workaround for automation, and that the REST interface for DB Connect could change in future versions.