All Apps and Add-ons

use dbx sql query as root search for a data model (splunk 6)

dominiquevocat
Motivator

It seems to me that the data model builder relies on events and since i don't receive events but rather a table of values i seem to fail in using the information gathered by a sql query as a root search for a data model.

Is there a way to consume data from a sql database and infuse it into a data model in Splunk 6? (like, mangling the db query results into events - after all they do have some datestamp i can reformat into a splunk conform timestamp)

Tags (2)
0 Karma
1 Solution

dominiquevocat
Motivator

As i see it one can create some collect search populating a special index and those items are events (if you can use some field as _time, else the indexing time is _time) and so you get events and can build a data model on top.

hope this helps someone 🙂

View solution in original post

0 Karma

dominiquevocat
Motivator

As i see it one can create some collect search populating a special index and those items are events (if you can use some field as _time, else the indexing time is _time) and so you get events and can build a data model on top.

hope this helps someone 🙂

View solution in original post

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!