Deployment Architecture

How to read from 3 different db connect systems?

a212830
Champion

Hi,

We have a set of databases that we want to query using db connect. The db's are in different regions and house the same type of performance data, but for devices local to that region. Is there a way to have db connect read both databases using db query?

Tags (2)
0 Karma
1 Solution

acharlieh
Influencer

If the search head is able to connect to all of them, then yes you can setup database connections to all of them: http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Createandmanagedatabaseconnections

Then just dbxquery connection=connection1 ... | append [dbxquery connection=connection2 ...] | ...

If not, you could also setup DBConnect on a Heavy Forwarder in each region, have these HFs regularly query and index data and forward to your Splunk indexer(s). Then just use normal Splunk queries to search the data. This has the downside of using Splunk Enterprise License (as you are now indexing data into Splunk), but a potential upside of adding indirection between your search head users and your database. (Obviously, you'd need the network paths open to either forward data, or search across remote Splunk indexers instead of the database connections).

View solution in original post

acharlieh
Influencer

If the search head is able to connect to all of them, then yes you can setup database connections to all of them: http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Createandmanagedatabaseconnections

Then just dbxquery connection=connection1 ... | append [dbxquery connection=connection2 ...] | ...

If not, you could also setup DBConnect on a Heavy Forwarder in each region, have these HFs regularly query and index data and forward to your Splunk indexer(s). Then just use normal Splunk queries to search the data. This has the downside of using Splunk Enterprise License (as you are now indexing data into Splunk), but a potential upside of adding indirection between your search head users and your database. (Obviously, you'd need the network paths open to either forward data, or search across remote Splunk indexers instead of the database connections).

a212830
Champion

Nice! Wasn't aware that was possible. Thanks.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...