All Apps and Add-ons

About relation of license usage and data types when input data from database.

yutaka1005
Builder

In database data size is affected by data types.

Also when inputs data from database by using DB_connect, I think splunk is understanding data types(int,char,timedata...etc) of each column.
*This is because data types are displayed when selecting columns to be used as timestamps.

So when Splunk inputs data from database by using DB_connect, is license usage affected by data types?

Or since Splunk recognizes and inputs data as a character string, does the data types not be related to license usage?

Also, if the former is correct, is it possible to set any data types to each column of data to be captured on Splunk and change the amount of license usage?

If someone knows about it and tells me, it would be greatly appreciated.

0 Karma

p_gurav
Champion

You can use this properties in props.conf along with inputs.conf:

[sourcetype_name]
INDEXED_EXTRACTIONS = CSV
FIELD_NAMES = <define your field>
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...