use dbx sql query as root search for a data model (splunk 6)

[dominiquevocat]

It seems to me that the data model builder relies on events and since i don't receive events but rather a table of values i seem to fail in using the information gathered by a sql query as a root search for a data model.

Is there a way to consume data from a sql database and infuse it into a data model in Splunk 6? (like, mangling the db query results into events - after all they do have some datestamp i can reformat into a splunk conform timestamp)

[dominiquevocat · Accepted solution]

As i see it one can create some collect search populating a special index and those items are events (if you can use some field as _time, else the indexing time is _time) and so you get events and can build a data model on top.

hope this helps someone 🙂