Splunk Search

Extracting data from Splunk using splunkmse

divam
Engager

Hi All,

We are using splunk and we need to extract application data into a Datawaehouse to report alongside other dimentions from different sources.

So we installed splunkmse as a virtual machine. Now when I use the admin user to create a table in mysql all is good and I am able to extract data, but unfortunately when I try the same with my own user, I am not able to 1) get all the saved searches. 2) The ones that get created do not show data.

Could anyone advise what I could be doing wrong, unortunately I cant have access to the admin user.

Any help is much appreciated.

Thanks, Divam

Tags (1)

Ron_Naken
Splunk Employee
Splunk Employee

I believe you will need DBA privileges to the mysql instance on SplunkMSE. If I recall, it modifies entries in the _schema database when it builds tables for the saved searches.

Have the admin ssh into SplunkMSE and run the following commands in mysql>:

CREATE USER 'divam'@'localhost' IDENTIFIED BY 'password';
GRANT ALL PRIVILEGES ON *.* TO 'divam'@'localhost' WITH GRANT OPTION;

That should give you all the necessary privileges without requiring admin access to the SplunkMSE virtual appliance. Determining what privileges/rights you will need without DBA access could be a significant undertaking.

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...