All Apps and Add-ons

Forwarding and Indexing from mySQL

Olivia_Cussen
Engager

Using mySQL data in Splunk with Splunk Search Language

Hi

I am currently using the Splunk DB Connect App. I have set up all of my Inputs and I am querying the tables in Splunk but I would prefer to just use the Splunk Search Language, is this possible?

Will I be able to pull together a dashboard with correlations from different data sources?

0 Karma

ktugwell_splunk
Splunk Employee
Splunk Employee

Hi Olivia,

It sounds like you've created a database connection and you're using the query page to run SQL queries?

If this is the case, you'll probably want to create an input to index the SQL results.

Here's a very brief process on on-boarding SQL data sources.

DB Connect V2 (Explorer tab)

  1. Create an identity - This is the credentials that Splunk will use to connect to the database
  2. Create a connection - Use the identity you created and create your connection to your MySQL Server
  3. Test your connection - Write your SQL statement, and test it. If you see results returned then you're on the right track - This is where it sounds like you are right now

Now, this is the part where you actually create the input
DBConnect V2 (Operations tab)

  1. Create a new Database input - Using the connection that you have created above
  2. On the "Choose and preview table" tab, you can select whether you just want to use the GUI to build your query, or click advanced to paste in your own query. Here you also need to decide if you want to index the entire table every time this input is run, or use a rising column(like id) to index only results that are greater than the last value from the rising column
  3. Chose your timestamp column and the interval you wish the input to run at, then chose your index and hit save, the input should start (If it's enabled)

Give it a minute or 2, and start searching index=your_index

If you haven't seen them already, here's our guide on DB Connect: http://docs.splunk.com/Documentation/DBX/2.4.0/DeployDBX/AboutSplunkDBConnect

If you want to debug your connections, take a look at splunkd.log, or dbx2.log

Thanks

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...