Forwarding and Indexing from mySQL

[Olivia_Cussen]

Using mySQL data in Splunk with Splunk Search Language

Hi

I am currently using the Splunk DB Connect App. I have set up all of my Inputs and I am querying the tables in Splunk but I would prefer to just use the Splunk Search Language, is this possible?

Will I be able to pull together a dashboard with correlations from different data sources?

[ktugwell_splunk]

Hi Olivia,

It sounds like you've created a database connection and you're using the query page to run SQL queries?

If this is the case, you'll probably want to create an input to index the SQL results.

Here's a very brief process on on-boarding SQL data sources.

DB Connect V2 (Explorer tab)

1. Create an identity - This is the credentials that Splunk will use to connect to the database
2. Create a connection - Use the identity you created and create your connection to your MySQL Server
3. Test your connection - Write your SQL statement, and test it. If you see results returned then you're on the right track - This is where it sounds like you are right now

Now, this is the part where you actually create the input
DBConnect V2 (Operations tab)

1. Create a new Database input - Using the connection that you have created above
2. On the "Choose and preview table" tab, you can select whether you just want to use the GUI to build your query, or click advanced to paste in your own query. Here you also need to decide if you want to index the entire table every time this input is run, or use a rising column(like id) to index only results that are greater than the last value from the rising column
3. Chose your timestamp column and the interval you wish the input to run at, then chose your index and hit save, the input should start (If it's enabled)

Give it a minute or 2, and start searching index=your_index

If you haven't seen them already, here's our guide on DB Connect: http://docs.splunk.com/Documentation/DBX/2.4.0/DeployDBX/AboutSplunkDBConnect

If you want to debug your connections, take a look at splunkd.log, or dbx2.log

Thanks