Archive
Highlighted

If we have database connectors set up in Splunk, can we create data models using database queries?

Explorer

Hello,

We have database connectors set up in Splunk to run database queries. Can you create Data Models using database queries?

Thanks,
Bindu

0 Karma
Highlighted

Re: If we have database connectors set up in Splunk, can we create data models using database queries?

SplunkTrust
SplunkTrust

you using db connect v1 or v2?

0 Karma
Highlighted

Re: If we have database connectors set up in Splunk, can we create data models using database queries?

Explorer

currently using v1. planning to move to v2

0 Karma
Highlighted

Re: If we have database connectors set up in Splunk, can we create data models using database queries?

Path Finder

I'm not entirely sure what you're trying to do here, but we have done the following:

  1. use db connect and run sql query to dump out hashes of files detected by symantec (sql database)
  2. db connect populates an index=detected_hashes
  3. created CIM-compatible fields mapping the database fields to the inventory datamodel (inventory datamodel has constraint=detected_hashes)
  4. inventory datamodel can be queried to return information in the detected_hashes index

all DM commands (like acceleration) work fine.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.