All Apps and Add-ons

How to export data from a Splunk to a database

nalia_v
Loves-to-Learn Everything

I am looking for ways to export data from a splanq to a database MS SQL.

I looked at the community but didn’t find anything how to export data from the splunk to any DB.

I found a way through DBconnect, but it doesn’t work because we have a distributed infrastructure splunk. through output.

We have DBconnect deployed on a heavy forwarder. 

And indexes are not stored on it, they are stored on a separate server, so I can’t fulfill the request through output.

On SH we are not going to put one DBConnect.

Is there any other way to upload data from the splanck to the database MSSQL ? 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @nalia_v ,

if you want to export Splunk data to a DB using DB-Connect, you have to install it on a Search Head, in this way, DB-Connect can see all the data.

Otherwise, the only way is export data from Splunk in a file and import it.

Ciao.

Giuseppe

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

as @gcusello said the normal way is to install it to SH too.  Also I prefer to install it to MC, so I can do status monitoring and health checks. If those are out of questions then another option is use your HF as SH for DBConnect if it can query needed data from your indexers. 

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...