All Apps and Add-ons
Highlighted

How do I configure DB Connect to Forward Events

Explorer

Hi,

I'm sure there is an easy answer to this. I have installed DB Connect on a search head and have it configured to watch a particular table. Setup saves without errors and I can see that the polling is active in dbx.log

I want to forward the events that DBC is picking up to my indexers. How do I do that? I don't want the search head to index the events itself, I just want to forward them on.

Thanks

0 Karma
Highlighted

Re: How do I configure DB Connect to Forward Events

Splunk Employee
Splunk Employee

Hi. It depends how you want to use the data... For instance, if you want it to be a lookup, you could outputlookup and then let Splunk take care of the rest.

0 Karma
Highlighted

Re: How do I configure DB Connect to Forward Events

Explorer

The data that I'm trying to extract from the DB is log data. I would like to see when I search in Splunk just like other events that I'm indexing.

0 Karma
Highlighted

Re: How do I configure DB Connect to Forward Events

Splunk Employee
Splunk Employee

I see. You need to configure an input then, http://docs.splunk.com/Documentation/DBX/1.0.10/DeployDBX/inputsspec

0 Karma
Highlighted

Re: How do I configure DB Connect to Forward Events

Splunk Employee
Splunk Employee

You need to configure an outputs.conf on your machine to forward to the indexers. Once you have an outputs.conf set up correctly, the instance will forward accordingly. It's okay to do this on a search head if load is light, but I would suggest you consider having a dedicated Splunk forwarder instance instead for collecting the data and then forwarding it.

(Do not simply enable your search head with the Forwarder or LightForwarder app. This will let you collect and forward data, yes, but it will also do things like disable the GUI that you would not want to happen on a search head.)

View solution in original post

Highlighted

Re: How do I configure DB Connect to Forward Events

Explorer

Thank you. Works. I had only configured UFs before, so I was unsure what to do configuring the search head to forward.

0 Karma