How to perform a query on the HF that will allow me to then send the data I return to a DB?

[dfurtaw]

Hi Splunk Answer guys/gals,

I have a question regarding DBConnect and I was curious if anyone had any insight on it. After reading the documentation, I'm still a bit unsure on how to use the DB Output feature that is included in dbconnect. I have dbconnect installed on one of our HF's but in order for the output command to work, I'll need to search the data that is in our Splunk Cloud instance. 

The HF is currently configured to send data to the indexers, but I'm stuck on figuring out how I'll be able to perform a query on the HF that will allow me to then send the data I return to a DB. Currently, I'm unable to pull any data on the HF.

Thank you!

DFurtaw

[chli_splunk · Accepted solution]

Unlike DBX input, DBX output is a custom search command to export data from Splunk search results to DB. So it has to run on search head rather than HF. In your case, I'm afraid you have to install DBX on search head, configure it and run DBX output like a search command.

[richgalloway]

For Splunk Cloud, you need to configure Hybrid Search so your local search head (which can be the HF) can fetch data from Cloud indexers.