topic Re: Splunk DB Connect and Neo4j anyone? in Splunk Search

Splunk DB Connect and Neo4j anyone?

Paolo_Prigione — Wed, 26 Jun 2013 08:19:58 GMT

I am trying to connect to Neo4j using their JDBC driver with no luck.
Has anybody done better than this?

Re: Splunk DB Connect and Neo4j anyone?

Damien_Dallimor — Wed, 26 Jun 2013 11:51:56 GMT

Haven't tried the JDBC driver, but as an alternative Neo4J has a REST Api.
http://docs.neo4j.org/chunked/milestone/rest-api.html

So you could perhaps try out the REST Modular Input.

Re: Splunk DB Connect and Neo4j anyone?

Paolo_Prigione — Wed, 26 Jun 2013 13:54:41 GMT

Nice idea, even though I would miss the opportunity of lookups, "in-search" query functionality. Also, to be able to populate Neo4j from splunk searches would be very nice. Think about tracing all the net connections of the prod servers with "lsof" scripts and draw the chart of the "live" infrastructure in external tools as well...

Re: Splunk DB Connect and Neo4j anyone?

markneedham — Tue, 09 Jul 2013 00:22:41 GMT

@Paolo what problems were you having with the JDBC driver?

Nice idea, even though I would miss the opportunity of lookups, "in-search" query functionality. Also, to be able to
populate Neo4j from splunk searches would be very nice.

Was also curious what you meant here? Could you provide a bit more detail...I might be able to help 🙂

Re: Splunk DB Connect and Neo4j anyone?

ziegfried — Thu, 11 Jul 2013 15:38:11 GMT

Most features of DB Connect won't work with Neo4j since it's using a custom query language, not SQL. The following features most-probably won't work:

Simple Database Lookups (Advanced lookups might work by specifying a custom query)
Database inputs based on a table (might work by specifying a custom query)
dboutput

Re: Splunk DB Connect and Neo4j anyone?

Paolo_Prigione — Fri, 12 Jul 2013 08:07:56 GMT

Thanks Ziegfried. As the N4J Jdbc driver states a bunch of sql interfaces (squirrelSQL and others...) which work with varying features, I was just hoping for an easy integration. But I understand it was totally out of scope for DBX.

Re: Splunk DB Connect and Neo4j anyone?

Paolo_Prigione — Fri, 12 Jul 2013 08:19:28 GMT

@Mark, my use cases would be:
1) run a custom, live query on N4J (like DBX's |dbquery or |inputlookup or |inputcsv) and process the results in the pipeline.
2) perform custom lookups;
3) populate N4J with data coming from a splunk search.
The use cases are multiple. E.g.
a)Import the graph of a network and see all impacted -"downstram"- devices in case of failure (a top-down approach);
b)Trace all the connections of the servers for which I have logs and draw their connections (bottom-up approach). This would give me, over time, a precise schema of the services a complex application is using.

Re: Splunk DB Connect and Neo4j anyone?

lekanneer — Thu, 29 Apr 2021 09:48:04 GMT

Not a DB Connect solution. But I do have created an app on splunkbase to pull data out of Neo4j into Splunk (https://splunkbase.splunk.com/app/5495/). Working on another app that can send Splunk data back to Neo4j (https://splunkbase.splunk.com/app/5508/).