How do I configure DB Connect to Forward Events

[jakesony]

Hi,

I'm sure there is an easy answer to this. I have installed DB Connect on a search head and have it configured to watch a particular table. Setup saves without errors and I can see that the polling is active in dbx.log

I want to forward the events that DBC is picking up to my indexers. How do I do that? I don't want the search head to index the events itself, I just want to forward them on.

Thanks

[gkanapathy · Accepted solution]

You need to configure an outputs.conf on your machine to forward to the indexers. Once you have an outputs.conf set up correctly, the instance will forward accordingly. It's okay to do this on a search head if load is light, but I would suggest you consider having a dedicated Splunk forwarder instance instead for collecting the data and then forwarding it.

(Do not simply enable your search head with the Forwarder or LightForwarder app. This will let you collect and forward data, yes, but it will also do things like disable the GUI that you would not want to happen on a search head.)

[jakesony]

Thank you. Works. I had only configured UFs before, so I was unsure what to do configuring the search head to forward.

[jcoates_splunk]

Hi. It depends how you want to use the data... For instance, if you want it to be a lookup, you could outputlookup and then let Splunk take care of the rest.

[jcoates_splunk]

I see. You need to configure an input then, http://docs.splunk.com/Documentation/DBX/1.0.10/DeployDBX/inputsspec

[jakesony]

The data that I'm trying to extract from the DB is log data. I would like to see when I search in Splunk just like other events that I'm indexing.