This is a question I am going to provide the answer to, I am curious how other sites have setup DB Connect for a large number of database connections.
The application has a nice interface and editing the configuration files is relatively straightforward, but I found the RESTful interface of Splunk particularly useful for DB Connect setup as I can create the identities, connections and inputs I need without clicking any buttons or editing files locally...
If anyone has an alternative/nicer solution feel free to provide alternative answers...
The information provided below relates to Splunk DB Connect V2, for Splunk DB Connect V3 refer to https://answers.splunk.com/answers/516111/splunk-db-connect-v3-automated-programmatic-creati.html#an...
The Splunk managing objects tutorial http://dev.splunk.com/view/managing-objects-tutorial/SP-CAAADQ5 covers the basics of the REST API, the part that I didn't know was where to access the URL:
https://localhost:8089/servicesNS/nobody/splunk_app_db_connect/
Allows access to the RESTful interface of the application, from here there are a few services in particular I found useful:
curl -k -u admin:changeme http://localhost:8089/servicesNS/nobody/splunk_app_db_connect/db_connect/identities/ -d "connection_type=oracle_service" -d "name=OracleTesting" -d "password=XXXX" -d "username=OracleUsername"
curl -k -u admin:changeme http://localhost:8089/servicesNS/nobody/splunk_app_db_connect/db_connect/connections -d "connection_type=oracle_service" -d "name=OracleTesting" -d "host=OracleHost" -d "database=OracleDB" -d "identity=OracleTesting"
curl -k -u admin:changeme http://localhost:8089/services/search/jobs/export -d search="| dbxquery query=\"alter user OracleUser identified by password replace oldpassword\" connection=\"OracleTesting\""
http://localhost:8089/servicesNS/nobody/splunk_app_db_connect/data/inputs/mi_input
Is the URL required to create a new input, there are a number of parameters to be passed in here which are well described in the service.
Good luck!
The information provided below relates to Splunk DB Connect V2, for Splunk DB Connect V3 refer to https://answers.splunk.com/answers/516111/splunk-db-connect-v3-automated-programmatic-creati.html#an...
The Splunk managing objects tutorial http://dev.splunk.com/view/managing-objects-tutorial/SP-CAAADQ5 covers the basics of the REST API, the part that I didn't know was where to access the URL:
https://localhost:8089/servicesNS/nobody/splunk_app_db_connect/
Allows access to the RESTful interface of the application, from here there are a few services in particular I found useful:
curl -k -u admin:changeme http://localhost:8089/servicesNS/nobody/splunk_app_db_connect/db_connect/identities/ -d "connection_type=oracle_service" -d "name=OracleTesting" -d "password=XXXX" -d "username=OracleUsername"
curl -k -u admin:changeme http://localhost:8089/servicesNS/nobody/splunk_app_db_connect/db_connect/connections -d "connection_type=oracle_service" -d "name=OracleTesting" -d "host=OracleHost" -d "database=OracleDB" -d "identity=OracleTesting"
curl -k -u admin:changeme http://localhost:8089/services/search/jobs/export -d search="| dbxquery query=\"alter user OracleUser identified by password replace oldpassword\" connection=\"OracleTesting\""
http://localhost:8089/servicesNS/nobody/splunk_app_db_connect/data/inputs/mi_input
Is the URL required to create a new input, there are a number of parameters to be passed in here which are well described in the service.
Good luck!