All Apps and Add-ons

How to export data from a Splunk to a database

nalia_v
Loves-to-Learn Everything

I am looking for ways to export data from a splanq to a database MS SQL.

I looked at the community but didn’t find anything how to export data from the splunk to any DB.

I found a way through DBconnect, but it doesn’t work because we have a distributed infrastructure splunk. through output.

We have DBconnect deployed on a heavy forwarder. 

And indexes are not stored on it, they are stored on a separate server, so I can’t fulfill the request through output.

On SH we are not going to put one DBConnect.

Is there any other way to upload data from the splanck to the database MSSQL ? 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @nalia_v ,

if you want to export Splunk data to a DB using DB-Connect, you have to install it on a Search Head, in this way, DB-Connect can see all the data.

Otherwise, the only way is export data from Splunk in a file and import it.

Ciao.

Giuseppe

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

as @gcusello said the normal way is to install it to SH too.  Also I prefer to install it to MC, so I can do status monitoring and health checks. If those are out of questions then another option is use your HF as SH for DBConnect if it can query needed data from your indexers. 

r. Ismo

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...