All Apps and Add-ons
Highlighted

How do I use the RESTful webservices to setup new DB Connect identities, connections and inputs?

SplunkTrust
SplunkTrust

This is a question I am going to provide the answer to, I am curious how other sites have setup DB Connect for a large number of database connections.

The application has a nice interface and editing the configuration files is relatively straightforward, but I found the RESTful interface of Splunk particularly useful for DB Connect setup as I can create the identities, connections and inputs I need without clicking any buttons or editing files locally...

If anyone has an alternative/nicer solution feel free to provide alternative answers...

0 Karma
Highlighted

Re: How do I use the RESTful webservices to setup new DB Connect identities, connections and inputs?

SplunkTrust
SplunkTrust

The information provided below relates to Splunk DB Connect V2, for Splunk DB Connect V3 refer to https://answers.splunk.com/answers/516111/splunk-db-connect-v3-automated-programmatic-creati.html#an...

The Splunk managing objects tutorial http://dev.splunk.com/view/managing-objects-tutorial/SP-CAAADQ5 covers the basics of the REST API, the part that I didn't know was where to access the URL:
https://localhost:8089/servicesNS/nobody/splunk_app_db_connect/

Allows access to the RESTful interface of the application, from here there are a few services in particular I found useful:

Creating an identity

curl -k -u admin:changeme http://localhost:8089/servicesNS/nobody/splunk_app_db_connect/db_connect/identities/ -d "connectiontype=oracleservice" -d "name=OracleTesting" -d "password=XXXX" -d "username=OracleUsername"

Creating a connection

curl -k -u admin:changeme http://localhost:8089/servicesNS/nobody/splunk_app_db_connect/db_connect/connections -d "connectiontype=oracleservice" -d "name=OracleTesting" -d "host=OracleHost" -d "database=OracleDB" -d "identity=OracleTesting"

Running a database query

curl -k -u admin:changeme http://localhost:8089/services/search/jobs/export -d search="| dbxquery query=\"alter user OracleUser identified by password replace oldpassword\" connection=\"OracleTesting\""

Creating an input

http://localhost:8089/servicesNS/nobody/splunk_app_db_connect/data/inputs/mi_input

Is the URL required to create a new input, there are a number of parameters to be passed in here which are well described in the service.

Good luck!

View solution in original post

0 Karma