All Apps and Add-ons

Can Splunk decompress the payload stored in a database and make it in text format as part of pulling the data?

amit97ee354
Explorer

We have integrated systems from app tier to the Databse where the run-time data (including the payload) at the App tier are stored in the DB. The component which pushes data to the DB is developed by DBA group. That component is compressing the payload data before pushing to the DB. When we connect to the DB, I just see ****binary**** as the payload column data. The application team is asking whether Splunk has a capability to decompress the payload and make it in text format as a part of pulling the data.

Are there any plugins available to perform the following?
o Takes a byte array as input
o Uses the .NET’s DefalateStream to do decompress for the given input array and result is de-compressed byte array
o Convert ‘De-compressed Byte array’ to String
o Returns the String

Appreciate your help and response if you have run into the similar kind of situation and/or have a solution for this problem

0 Karma

woodcock
Esteemed Legend

You need to use a scripted input to convert the binary payload to text:

http://docs.splunk.com/Documentation/Splunk/6.3.1/AdvancedDev/ScriptedInputsIntro

Once you get that working, to abstract away the guts, make it modular input:

http://docs.splunk.com/Documentation/Splunk/6.3.1/AdvancedDev/Modinputsintro

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...