How to export data from a Splunk to a database

[nalia_v]

I am looking for ways to export data from a splanq to a database MS SQL.

I looked at the community but didn’t find anything how to export data from the splunk to any DB.

I found a way through DBconnect, but it doesn’t work because we have a distributed infrastructure splunk. through output.

We have DBconnect deployed on a heavy forwarder. 

And indexes are not stored on it, they are stored on a separate server, so I can’t fulfill the request through output.

On SH we are not going to put one DBConnect.

Is there any other way to upload data from the splanck to the database MSSQL ? 

[gcusello]

Hi @nalia_v ,

if you want to export Splunk data to a DB using DB-Connect, you have to install it on a Search Head, in this way, DB-Connect can see all the data.

Otherwise, the only way is export data from Splunk in a file and import it.

Ciao.

Giuseppe

[isoutamo]

Hi

as @gcusello said the normal way is to install it to SH too.  Also I prefer to install it to MC, so I can do status monitoring and health checks. If those are out of questions then another option is use your HF as SH for DBConnect if it can query needed data from your indexers. 

r. Ismo