All Apps and Add-ons

Using splunk to check your log against database

c0mrade
Explorer

Hello all, I'm a new splunk user and I'm not familiar yet with all its features. I have a rather unusual(or not) thing in mind to do with splunk.

I have a jboss application server log, in which I have all request towards 3rd party service logged. Each request has requestId which could be extracted.

I want to use those extracted requestIds to query the 3rd party service database and to compare the results which I get with those in my log.

I realize that I'll have to do some scripting to do this, my question is : is splunk overhead for this? or I'd be better of writing some script for this.

Anyone had similar expiriences?

Tags (2)
0 Karma
1 Solution

jbsplunk
Splunk Employee
Splunk Employee

You can use splunk to pull entries from a database, but it will require the input you setup be a scripted input. So, yes, you can do it. However, as you suspected, it will require some scripting to do accomplish the task.

There have been a few posts about this over the last week which I find you'll probably find to be helpful and applicable to your particular scenario.

http://splunk-base.splunk.com/answers/23846/how-do-i-setup-an-input-for-sql-data?page=1#23857

http://splunk-base.splunk.com/answers/23772/index-a-db-log

View solution in original post

0 Karma

jbsplunk
Splunk Employee
Splunk Employee

You can use splunk to pull entries from a database, but it will require the input you setup be a scripted input. So, yes, you can do it. However, as you suspected, it will require some scripting to do accomplish the task.

There have been a few posts about this over the last week which I find you'll probably find to be helpful and applicable to your particular scenario.

http://splunk-base.splunk.com/answers/23846/how-do-i-setup-an-input-for-sql-data?page=1#23857

http://splunk-base.splunk.com/answers/23772/index-a-db-log

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...