Can I copy the indexed data to my Data Wareshouse for inclusion in enterprise reporting tools?

[Jake_Edwards]

I am interested in copying some of and maybe all the indexed data from splunk to our enterprise data warehouse(Oracle 11G) for inclusion in our enterprise reporting solutions. Is this possible?

[bchen]

One way is to utilize CSV data format as the means by which to transfer data.

You can select what you want via coming up with the search string that gets the dataset that you want to import to Oracle. Search results are tabular, so it can easily be imported to a table in oracle.

You can then export to a csv file via the "outputcsv" command, for instance:

‘sourcetype=”samplesourcetype” SenderIP=”192.168.0.12” | outputcsv myoutputfile.csv’

(see: http://blogs.splunk.com/2009/08/07/help-i-cant-export-more-than-10000-events/)

You can then import via SQL Loader into a table. (table creation, metadata mapping, etc. is left as an exercise to the user)

Hope this helps!

[jbsplunk]

Yes, it is possible. You can use the documentation here to set something like this up:

http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Forwarddatatothird-partysystemsd

[jbsplunk]

data can be forwarded to the oracle system using this mechanism and then formatted accordingly. the CSV approach is certainly valid, but it won't get the data into the oracle database. The data still has be be transferred.

[bchen]

Unsure how this applies to Oracle.