topic Re: pushing splunk results automatically in Reporting

pushing splunk results automatically

riderofyamaha — Thu, 10 Jun 2010 22:28:02 GMT

I have a question regarding having specific splunk data that is automatically searched for exported to a different database automatically. not much information i know, but i cant think of how else to ask, thanks for your input

Re: pushing splunk results automatically

hulahoop — Fri, 11 Jun 2010 04:44:17 GMT

I can think of 3 ways to accomplish this:

Scripted Alert - setup a schedule search which kicks off a script to write the results of the search to a database. Splunk will schedule and execute the search, pass the search results to the script, and the script will handle the DB connection and write. This would be completely automated. How to create a scripted alert.
Custom Search Command - create a Splunk search command which can be used inline on the search bar with any search. Use the search command just like you would the fields, top, stats commands. For example, your search would call this new command like this: ... | export2DB. This calls a python script on the backend to handle the actual DB connection and writes. How to create a custom search command.
Event-Level Workflow - add an option in the event drop-down menu to write the event to the DB. This is similar to the first 2 options, but operates on a per-event basis rather than the entire result set. How to create a workflow action.

I hope this gives you some options. Let us know how you proceed.

Re: pushing splunk results automatically

Lowell — Sat, 12 Jun 2010 03:08:52 GMT

You may want to check SplunkMSE. See the Splunk MySQL Storage Engine blog entry for additional info.

Re: pushing splunk results automatically

riderofyamaha — Tue, 22 Jun 2010 20:39:55 GMT

thank you, very helpfull