Deployment Architecture

How to read from 3 different db connect systems?

a212830
Champion

Hi,

We have a set of databases that we want to query using db connect. The db's are in different regions and house the same type of performance data, but for devices local to that region. Is there a way to have db connect read both databases using db query?

Tags (2)
0 Karma
1 Solution

acharlieh
Influencer

If the search head is able to connect to all of them, then yes you can setup database connections to all of them: http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Createandmanagedatabaseconnections

Then just dbxquery connection=connection1 ... | append [dbxquery connection=connection2 ...] | ...

If not, you could also setup DBConnect on a Heavy Forwarder in each region, have these HFs regularly query and index data and forward to your Splunk indexer(s). Then just use normal Splunk queries to search the data. This has the downside of using Splunk Enterprise License (as you are now indexing data into Splunk), but a potential upside of adding indirection between your search head users and your database. (Obviously, you'd need the network paths open to either forward data, or search across remote Splunk indexers instead of the database connections).

View solution in original post

acharlieh
Influencer

If the search head is able to connect to all of them, then yes you can setup database connections to all of them: http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Createandmanagedatabaseconnections

Then just dbxquery connection=connection1 ... | append [dbxquery connection=connection2 ...] | ...

If not, you could also setup DBConnect on a Heavy Forwarder in each region, have these HFs regularly query and index data and forward to your Splunk indexer(s). Then just use normal Splunk queries to search the data. This has the downside of using Splunk Enterprise License (as you are now indexing data into Splunk), but a potential upside of adding indirection between your search head users and your database. (Obviously, you'd need the network paths open to either forward data, or search across remote Splunk indexers instead of the database connections).

a212830
Champion

Nice! Wasn't aware that was possible. Thanks.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...