Splunk DB Connect: Is there a way to have input data in JSON or CSV format to have automatic field indexing by Splunk?

[anatoliikostin]

I have several DB connections with inputs configured. Everything works very well.
But there is one performance issue which I haven't been able to solve yet: when using Splunk search queries take long time to execute.
Usually, I make sure that all fields are indexed and then it's possible to use |tstats and make super-fast dashboards.
But I couldn't do the same for DB connect data as indexed time field extractions don't work there.

Is there a way to have input data in json or csv format to have automatic field indexing by Splunk?
Anyway all data coming from databases has predefined fields which could be immediately indexed to improve query performance greatly.

Thanks for your answer!

[claudio_manig]

My thoughts exactly - i dont get the point why dbx ingests data using hec with json instead of simple csv as a db would perfectly be suited for that. Most of the use cases we dont care about ingestion speed (advantage of hec) but we do care about search performance (indexed fields).

[jcoates]

I’m not sure if it will be possible, it’s either easy or not possible. DBX sends JSON to a local HEC. There’s two ways to get indexed extractions from HEC. If using the correct endpoint and sourcetype, it could just mean configuration flags. Or it needs manipulating the source data, in which case you’re out of luck.

http://dev.splunk.com/view/event-collector/SP-CAAAFB6

I don’t recall if DBX is using the raw endpoint; if so, this won’t work.

If it is using the events endpoint and if it’s forming the JSON as expected, then you might be able to just turn on indexed extractions in props.conf for the sourcetype.

Good luck!