All Apps and Add-ons

Is it possible to use Splunk DB Connect to search MongoDB?

diogofgm
SplunkTrust
SplunkTrust

I'm using Splunk Enterprise (licensed) and i want to connect to an external MongoDB to search data stored there. I don't to want to index any of this data.
- I don't have a Hunk license. Can i still use the Hunk App for MongoDB?
- Is it viable to use Splunk DB connect?
Already looked into some posts here but most are almost 2 years old and some of the answers are not really enlightening on a good way to achieve this.

------------
Hope I was able to help you. If so, some karma would be appreciated.
1 Solution

rdagan_splunk
Splunk Employee
Splunk Employee

I was working with the Unity JDBC driver ( http://www.unityjdbc.com/mongojdbc/mongo_jdbc.php ) and got DB Connect to work with MongoDB using this stanza
[mongo2]
displayName = MongoDB2
serviceClass = com.splunk.dbx2.DefaultDBX2JDBC
jdbcUrlFormat = jdbc:mongodb:// < host > : < port > / < database >

jdbcDriverClass = mongodb.jdbc.MongoDriver
port = 27017

View solution in original post

rdagan_splunk
Splunk Employee
Splunk Employee

I was working with the Unity JDBC driver ( http://www.unityjdbc.com/mongojdbc/mongo_jdbc.php ) and got DB Connect to work with MongoDB using this stanza
[mongo2]
displayName = MongoDB2
serviceClass = com.splunk.dbx2.DefaultDBX2JDBC
jdbcUrlFormat = jdbc:mongodb:// < host > : < port > / < database >

jdbcDriverClass = mongodb.jdbc.MongoDriver
port = 27017

kc64645
Explorer

How do you install jdbc drivers for mongodb? I copied jar file mongo-java-driver-3.7.1.jar to $SPLUNK_HOME/etc/apps/splunk_app_db_connect/drivers directory but I still see below errors. My DB connect version is 3.1.2

action=load_drivers Can not load any driver from files [$SPLUNK_HOME/etc/apps/splunk_app_db_connect/drivers/mongo-java-driver-3.7.1.jar]

0 Karma

bestSplunker
Contributor
0 Karma

diogofgm
SplunkTrust
SplunkTrust

Sorry on the delay.. but haven't been around the place to test this! It works. Thanks

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma

barakharyati1
New Member

hi foloow the steps but still all searches return empty (and no collections return to the data lab )

0 Karma

jkat54
SplunkTrust
SplunkTrust

The answer is simple and it's listed on the overview of the dbconnect app:

Splunk DB Connect is the best solution for working with databases from Splunk. It can help you quickly integrate structured data sources with your Splunk real-time machine data collection. Supports DB2/Linux, Informix, MemSQL, MySQL, AWS Aurora, Microsoft SQL Server, Oracle, PostgreSQL, AWS RedShift, SAP SQL Anywhere, Sybase ASE, Sybase IQ, and Teradata.

https://splunkbase.splunk.com/app/2686/

It wouldnt be too hard to write a custom search command to do this however. In fact, there is a curl command in "JKat's Toolkit" found here: https://splunkbase.splunk.com/app/3265/.

Such a command could be modified to search just mongodb but as I understand it, mongodb is just a RESTful / API driven DB store. You should be able to use that curl command just fine.

0 Karma

DUThibault
Contributor

There isn't a curl command in JKat's toolkit (jkats-toolkit_006) since December 2016. There are only the commands motd, decimaltoip, and randomint. The curl and urlencode commands have moved to TA-Webtools (https://splunkbase.splunk.com/app/3420/).

0 Karma

hgrow
Communicator

Hi diogofgm,

Looking at your question i stumbled across this:
https://answers.splunk.com/answers/89828/mongodb-and-splunk.html
http://www.unityjdbc.com/mongojdbc/setup/mongodb_jdbc_splunk.pdf

i have not tried to query a mongoDB with splunk, but just from reading the docs:
http://docs.splunk.com/Documentation/DBX/2.3.1/DeployDBX/Supporteddatabases#Other_databases

In addition to the supported databases that Splunk has tested and certified for use with DB Connect, you may also be able to use unsupported JDBC-compatible databases with Splunk DB Connect. You will need to provide the necessary JDBC drivers to add your own database types. For more information, see Install drivers for other databases. 

I bet you can do the same with DBX 2 as referred in the pdf/answer above.

Maybe it helps

0 Karma

nnmiller
Contributor

DB Connect is not intended for searching databases, it's intended to pull data into Splunk for indexing. It doesn't allow you to just query a database and display it in the Splunk WebUI.

0 Karma

niketn
Legend

@nnmiller Splunk DB Connect 2 allows querying of database to be displayed in Splunk Web UI through DB Lookups Operations. Advantage is that it will not add to daily indexing volume, however, it will impact performance of Database as they will be queried directly through Splunk.

Having said that MongoDB is not listed in supported DBs for DB Connect 2 app. http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Supporteddatabases

Hunk App for MongoDB seems to be only possibility for this. However, it is better to check with Splunk representatives on Licensing/cost.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...