All Apps and Add-ons
Highlighted

Use DBConnect/dbxquery to Populate a Lookup Table having more than a Million Rows

Explorer

Hello Splunkers,
What is the best possible approach to use inorder to build a Lookup table in Splunk which would have more than a Million Rows, the source of which is a Database Table.

I have tried using DbConnect to fetch the data and Index it into Splunk, but to make it usable we end up needing to run a subsearch for all time and also dedup the results. The issue with the above is that 1) Its Slow 2) Sub-Search Needs to run on all time.

Thanks.

0 Karma
Highlighted

Re: Use DBConnect/dbxquery to Populate a Lookup Table having more than a Million Rows

Influencer

Is this maybe what you are looking for?

0 Karma
Highlighted

Re: Use DBConnect/dbxquery to Populate a Lookup Table having more than a Million Rows

Esteemed Legend

You could build another system that access the DB and publishes the list on a webserver and use this app:

https://splunkbase.splunk.com/app/635/

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.