All Apps and Add-ons

Can Splunk decompress the payload stored in a database and make it in text format as part of pulling the data?

amit97ee354
Explorer

We have integrated systems from app tier to the Databse where the run-time data (including the payload) at the App tier are stored in the DB. The component which pushes data to the DB is developed by DBA group. That component is compressing the payload data before pushing to the DB. When we connect to the DB, I just see ****binary**** as the payload column data. The application team is asking whether Splunk has a capability to decompress the payload and make it in text format as a part of pulling the data.

Are there any plugins available to perform the following?
o Takes a byte array as input
o Uses the .NET’s DefalateStream to do decompress for the given input array and result is de-compressed byte array
o Convert ‘De-compressed Byte array’ to String
o Returns the String

Appreciate your help and response if you have run into the similar kind of situation and/or have a solution for this problem

0 Karma

woodcock
Esteemed Legend

You need to use a scripted input to convert the binary payload to text:

http://docs.splunk.com/Documentation/Splunk/6.3.1/AdvancedDev/ScriptedInputsIntro

Once you get that working, to abstract away the guts, make it modular input:

http://docs.splunk.com/Documentation/Splunk/6.3.1/AdvancedDev/Modinputsintro

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...