topic Re: Combine DB Connect and Search Data in Knowledge Management

Combine DB Connect and Search Data

bcusick — Mon, 03 Feb 2014 21:17:28 GMT

Hi,

Yesterday I upgraded Splunk to 6.0.1 (thank god) and configured DB Connect to fetch from a database.

I am trying to combine this database data with information coming in from log sources in my Search app. Any recommendation on the easiest way to do this?

-Can I send DB Connect data to Search?

-Can I search DB Connect data from within Search without having to send to the Search index?

Thanks,

Re: Combine DB Connect and Search Data

araitz — Thu, 06 Feb 2014 18:09:26 GMT

Not sure I understand. Do you want to send data from a database input to the main index? Or something else?

Re: Combine DB Connect and Search Data

okrabbe_splunk — Sun, 09 Feb 2014 21:20:49 GMT

Yes, you can use the DB Connect search commands and lookups. The most common usage of DB Connect is to use lookups from a database table to enrich machine data.

That is well documented here:
Setup a lookup table

The other option is to use the DB connect search commands such as dbquery:
DB Connect search commands

As an example, you could use dbquery on it's own or you could join it, use it in a subsearch, append it and more.

Here is what the dbquery command looks like:

| dbquery ASSET_DB "SELECT id,name, ip_address,owner,last_update FROM hosts WHERE active = 1"

That should be pretty easy to understand.

Re: Combine DB Connect and Search Data

bcusick — Tue, 18 Feb 2014 17:57:02 GMT

Adding a input type gave me exactly what I needed and even parsed the fields for me. This tool just got so much more versatile. Thanks.

Re: Combine DB Connect and Search Data

lopessp — Thu, 15 Jan 2015 14:10:28 GMT

Great! Thanks okrabbe