All Apps and Add-ons
Highlighted

How do I configure DB Connect Outputs to send data from a search head?

Engager

I currently have a connection set up from my Splunk search head(SH) in DB Connect to an external database where I'm trying to export the results of a Splunk search. The search works correctlyd. I have both read and write permissions to the relevant database and the target tables, my fields are mapped correctly, and I'm not seeing any errors in my internal db logs. The issue is, however, that despite everything appearing to work on the surface, I'm not seeing any data appear in the DB table as expected.

The data source for the search is indexed via an Http Event Collector connection. The goal is to take this indexed data, perform some aggregate calculations, and then export the result to another Database. I am able to access this index through my SH, but not through my Heavy Forwarder(HF). How can I get this data exported to this database? If it's not possible directly from the SH, then is there a way for me to first send the data to the HF and then establish a DB Connect connection from there?

Any and all help would be much appreciated!

0 Karma
Highlighted

Re: How do I configure DB Connect Outputs to send data from a search head?

Esteemed Legend

What version of dbconnect are you using? What is your search SPL (or at least the last 2 pipes of it)?

0 Karma
Highlighted

Re: How do I configure DB Connect Outputs to send data from a search head?

SplunkTrust
SplunkTrust

Have you looked at the search log (via Job Inspector) to see what errors, if any, are reported?

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: How do I configure DB Connect Outputs to send data from a search head?

Communicator

How is it configured currently within the SH? Do you have DBConnect installed there? How have you set it up to be forwarded?

0 Karma