Getting Data In

How to get data structure and some data from Splunk?

kirillchokparov
Explorer

Our client has been using Splunk to research logs from IT systems.
I need to make Java-integration with his Splunk. So to do this I need to understand the structure of his data.
For the first visit I would like to get the structure and some data from the client.
I have never worked with Splunk only with databases like Oracle and PostgreSQL.

Is this possible to make some dump from the existing Splunk to get structure of the data? Also it would be nice to have some way to get some data for testing purpose.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Data in Splunk is unstructured (with a couple of exceptions we can ignore for now). One of the distinguishing features of Splunk is a schema is not applied to the data until it is searched. This allows for flexible "schemas" for each use case.

The best way to integrate Splunk with SQL databases is to use the DB Connect app.

You'll have to get test data from your client.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

lfedak_splunk
Splunk Employee
Splunk Employee

Hey @kirillchokparov, there's a Slack as well and some of the channels might help: http://splk.it/slack
Have you seen the developer portal? http://dev.splunk.com/
And we have a free intro e-learning course if you want to learn a bit more about Splunk. https://www.splunk.com/view/education/SP-CAAAAH9
Here's info about the Splunk DB Connect app that @richgalloway mentioned: https://splunkbase.splunk.com/app/2686/ you can check out other pre-built apps in Splunkbase

kirillchokparov
Explorer

Thanks @Ifedak. Very usefull information.

richgalloway
SplunkTrust
SplunkTrust

Data in Splunk is unstructured (with a couple of exceptions we can ignore for now). One of the distinguishing features of Splunk is a schema is not applied to the data until it is searched. This allows for flexible "schemas" for each use case.

The best way to integrate Splunk with SQL databases is to use the DB Connect app.

You'll have to get test data from your client.

---
If this reply helps you, Karma would be appreciated.

kirillchokparov
Explorer

@richgalloway, good day! Could you please tell what are the ways to get test data from Splunk? Can I somehow export the data from Splunk or I should get source files like CSV, that were added to Splunk by the client previously?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes, data can be exported from Splunk. Run a search for the desired data then click the Export icon (next to the printer icon).

---
If this reply helps you, Karma would be appreciated.

kirillchokparov
Explorer

Great. That works!

0 Karma

kirillchokparov
Explorer

Thank you.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...