How to define metadata in Splunk db connect and how to use database input in search?

[clairebesson]

Hi everyone,
I am using Splunk db connect v2. I created identities and connections. I also created a database input. The query displays the table with the different fields.
I don’t know what to enter for source, sourcetype and index. Do I have to create new one? I tried to put the name of my database input in those fields but Splunk displays an alert message.
I am not able to do a search like source=”nameofmyinput”.
Could you please help me with that?

Thanks in advance,
Claire

[woodcock · Accepted solution]

You can enter anything you like for sourcetype (or let splunk pick/set it for you) but source should not even be settable by you. There should be a listbox for picking index from a list of what already exists on your Indexers. Set the sourcetype to something you know is unique like ThisSourcetypeIsUnique and then try a search like this:

index=* sourcetype="ThisSourcetypeIsUnique"

[clairebesson]

Thank you very much for your help.