All Apps and Add-ons

Create a lookup to get the size on disk of a SQL Database file

andylee53
New Member

Hi New to the idea of connectting Splunk to my databases. I have installed DB Connect v2 on my Splunk Enterprise and got a working connection to the database I want to get the information from. I have got the query right and I'm getting results that show the size of the log and mdb files on disk along with info like file path etc. I'm happy with what I can see.

However I have no idea how to approach the next step i.e. Choose the splunk fiels to base the search on. I just don't understand what I'm supposed to put in here. I,ve read the documentation and if I do a simple search like index=* I get loads of fields to choose from but not sure which to select or why!!!

Any ideas or am I doing this the wrong way completely. All I want to do is create a scheduled report from the lookup to be able to emain it to the DBA.

Andy

0 Karma

aakwah
Builder

Hello,

At the end you should have an input stanza in inputs.conf (Splunk_Home/etc/apps/splunk_app_db_connect/local/inputs.conf) as per the following:

[mi_input://DB_Connection]
connection = Connection_Name
index = your_index
input_timestamp_column_name = coulmn_name_that_contains_timestamp
interval = 20
max_rows = 10000
mode = tail
output_timestamp_format = yyyy-MM-dd HH:mm:ss
query = your_sql_query
sourcetype = your_sourcetype
tail_follow_only = 1
tail_rising_column_name = coulmn_used_to_track_new_entries
ui_query_mode = advanced
ui_query_schema = your_schema
ui_query_table = table_name

Now you can reach the indexed data using the index or sourcetype.

Regards

0 Karma

andylee53
New Member

Hi aakwah

Thanks for this. I assume this requires me to index the data into splunk. Is there no way to just pull the data via a lookup without indexing it and run a report based on it. I only have a 1Gb data license and didn't particularly want to index anything just for this size report which will only be running 2 times a day at most

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...