How to Pull SQL data into Splunk

[bcusick]

Hi,

I am trying to pull data from a MSSQLSERVER table that updates in real time. This is a remote source. From my research I believe I will have to put a script in my input files. If someone could point me in the right direction it would be greatly appreciated!

This will have to be done without the use of Splunk's log forwarders...I am running Splunk 5.0.4.

-Brian

[ChrisG · Accepted solution]

Have you looked at the Splunk DB Connect app? Are you unable to use any forwarding at all?

[gauravp]

Unfortunately only works with enterprise version.. How about splunk light?

[bcusick]

Thank you!

[ChrisG]

From the very next topic in the documentation (http://docs.splunk.com/Documentation/DBX/1.1.1/DeployDBX/Configuredatabasemonitoring): "A Database input lets you fetch and index data from a SQL database. Unlike other input sources, database inputs are retrieved periodically by the DBmon scheduler."

[bcusick]

Thanks Chris. One last question which I could not find a specific answer on...would this require putting any sort of forwarder on the database server? Or is Splunk strictly just running a query against a connected database?

[ChrisG]

Yes, you can. http://docs.splunk.com/Documentation/DBX/1.1.1/DeployDBX/Addadatabaseconnection

[bcusick]

Unfortunately for compliance reasons, I don't believe I'm allowed to install anything on these machines. After research-with splunk DB connect, can I connect to a db on a remote server and just query the DB, pulling the data into Splunk? That would be perfect.