All Apps and Add-ons

How to use a database output

matstap
Communicator

I created a database output in Splunk DB Connect and gave it a schedule... Now what? I would like to run it now, but I can't find it in my scheduled jobs or saved searches. How can I run the output right now?

I'm in a clustered environment, so the schedule won't work(?)

0 Karma
1 Solution

Richfez
SplunkTrust
SplunkTrust

Hi!

As you've found, there's no direct and easy way to just "run" a dboutput. I wish there was, and have an Enhancement Request in to Splunk for this, but as of the latest version it's still not there.

There are two methods I use for all my dboutputs (at $job-1 we had 30 or 40).

1) Schedule it initially with a fake cron schedule of, say, */5 * * * * to run every 5 minutes. Let it run once, then edit the input to set it to the "right" schedule. The only challenge is to make */5 be small enough that it's not an eternity, but long enough that you can actually disable it before it runs twice. Either every 5 or every 10 minutes was what I usually used.

2) Or, use dbxoutput to run the output initially. The biggest pain in the rear is the dbxoutput command does not do any of the search-side stuff. For some reason my brain continues - even after all this time - to insist that dbxoutput should run the entire thing as configured. But it doesn't, it only runs the output side of things. So my process when I used this was to build my dboutput using the UI as usual. EXCEPT, be sure to copy and paste the search you run temporarily into a text editor. Then, once you've finished the dboutput, open a new search window, paste in your search, and append to it | dbxoutput output=<mydboutputname>. If you do that, your search will run and it'll also push the output to your db.

Hopefully one of these two methods will work for you!

Happy Splunking!
-Rich

View solution in original post

Richfez
SplunkTrust
SplunkTrust

Hi!

As you've found, there's no direct and easy way to just "run" a dboutput. I wish there was, and have an Enhancement Request in to Splunk for this, but as of the latest version it's still not there.

There are two methods I use for all my dboutputs (at $job-1 we had 30 or 40).

1) Schedule it initially with a fake cron schedule of, say, */5 * * * * to run every 5 minutes. Let it run once, then edit the input to set it to the "right" schedule. The only challenge is to make */5 be small enough that it's not an eternity, but long enough that you can actually disable it before it runs twice. Either every 5 or every 10 minutes was what I usually used.

2) Or, use dbxoutput to run the output initially. The biggest pain in the rear is the dbxoutput command does not do any of the search-side stuff. For some reason my brain continues - even after all this time - to insist that dbxoutput should run the entire thing as configured. But it doesn't, it only runs the output side of things. So my process when I used this was to build my dboutput using the UI as usual. EXCEPT, be sure to copy and paste the search you run temporarily into a text editor. Then, once you've finished the dboutput, open a new search window, paste in your search, and append to it | dbxoutput output=<mydboutputname>. If you do that, your search will run and it'll also push the output to your db.

Hopefully one of these two methods will work for you!

Happy Splunking!
-Rich

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...