All Apps and Add-ons

What is the best method for connecting with a MySQL database that resides on the Splunk Server

FreeSplunk64
New Member

I am new to Splunk (6.3) and am interested in knowing a few things in addition to the original question:

A. Assuming I can connect to a locally residing MySQL database (5.7) and extract rows from the database is it more efficient to:
1. Have Splunk operate directly on the results of queries against the database OR
2. Have Splunk operate on the results of the query that are stored as a CSV file on the Splunk Server.

B. How do I estimate (ahead of time) the size of the index that will be created using either method.

0 Karma

koshyk
Super Champion

Best way to query a database (local or remote) is using Splunk DBconnect (v2). DBconnectv2 will handle pooling and caching etc. It can import the table in block by block basis, so you can test plan before you load whole of the system. (You can operate the database like a lookup if you don't want to index it.)

0 Karma

tjr1775
Path Finder

Check to see if this works for you:
https://splunkbase.splunk.com/app/2686/

Unless you can automate the production of the CSV, the export of the CSV from MySQL, and the import into Splunk, then that becomes cumbersome. Also, consider the max limits of a CSV- not sure how big your datasets are.

Here is the method for estimating size (you'll need a sample dataset):
http://docs.splunk.com/Documentation/Splunk/6.5.0/Capacity/Estimateyourstoragerequirements

There are so many factors that go into efficiency in your scenario I would use the DB connect app and also the CSV method and see which you find easier.

0 Karma
Get Updates on the Splunk Community!

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...