Archive
Highlighted

How to get data structure and some data from Splunk?

Our client has been using Splunk to research logs from IT systems.
I need to make Java-integration with his Splunk. So to do this I need to understand the structure of his data.
For the first visit I would like to get the structure and some data from the client.
I have never worked with Splunk only with databases like Oracle and PostgreSQL.

Is this possible to make some dump from the existing Splunk to get structure of the data? Also it would be nice to have some way to get some data for testing purpose.

0 Karma
Highlighted

Re: How to get data structure and some data from Splunk?

SplunkTrust
SplunkTrust

Data in Splunk is unstructured (with a couple of exceptions we can ignore for now). One of the distinguishing features of Splunk is a schema is not applied to the data until it is searched. This allows for flexible "schemas" for each use case.

The best way to integrate Splunk with SQL databases is to use the DB Connect app.

You'll have to get test data from your client.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

Highlighted

Re: How to get data structure and some data from Splunk?

Thank you.

0 Karma
Highlighted

Re: How to get data structure and some data from Splunk?

@richgalloway, good day! Could you please tell what are the ways to get test data from Splunk? Can I somehow export the data from Splunk or I should get source files like CSV, that were added to Splunk by the client previously?

0 Karma
Highlighted

Re: How to get data structure and some data from Splunk?

SplunkTrust
SplunkTrust

Yes, data can be exported from Splunk. Run a search for the desired data then click the Export icon (next to the printer icon).

---
If this reply helps you, an upvote would be appreciated.
Highlighted

Re: How to get data structure and some data from Splunk?

Great. That works!

0 Karma
Highlighted

Re: How to get data structure and some data from Splunk?

Splunk Employee
Splunk Employee

Hey @kirillchokparov, there's a Slack as well and some of the channels might help: http://splk.it/slack
Have you seen the developer portal? http://dev.splunk.com/
And we have a free intro e-learning course if you want to learn a bit more about Splunk. https://www.splunk.com/view/education/SP-CAAAAH9
Here's info about the Splunk DB Connect app that @richgalloway mentioned: https://splunkbase.splunk.com/app/2686/ you can check out other pre-built apps in Splunkbase

Highlighted

Re: How to get data structure and some data from Splunk?

Thanks @Ifedak. Very usefull information.