All Apps and Add-ons

What is the best method for connecting with a MySQL database that resides on the Splunk Server

New Member

I am new to Splunk (6.3) and am interested in knowing a few things in addition to the original question:

A. Assuming I can connect to a locally residing MySQL database (5.7) and extract rows from the database is it more efficient to:
1. Have Splunk operate directly on the results of queries against the database OR
2. Have Splunk operate on the results of the query that are stored as a CSV file on the Splunk Server.

B. How do I estimate (ahead of time) the size of the index that will be created using either method.

0 Karma

Super Champion

Best way to query a database (local or remote) is using Splunk DBconnect (v2). DBconnectv2 will handle pooling and caching etc. It can import the table in block by block basis, so you can test plan before you load whole of the system. (You can operate the database like a lookup if you don't want to index it.)

0 Karma

Path Finder

Check to see if this works for you:

Unless you can automate the production of the CSV, the export of the CSV from MySQL, and the import into Splunk, then that becomes cumbersome. Also, consider the max limits of a CSV- not sure how big your datasets are.

Here is the method for estimating size (you'll need a sample dataset):

There are so many factors that go into efficiency in your scenario I would use the DB connect app and also the CSV method and see which you find easier.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...