How to read from 3 different db connect systems?

[a212830]

Hi,

We have a set of databases that we want to query using db connect. The db's are in different regions and house the same type of performance data, but for devices local to that region. Is there a way to have db connect read both databases using db query?

[acharlieh · Accepted solution]

If the search head is able to connect to all of them, then yes you can setup database connections to all of them: http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Createandmanagedatabaseconnections

Then just dbxquery connection=connection1 ... | append [dbxquery connection=connection2 ...] | ...

If not, you could also setup DBConnect on a Heavy Forwarder in each region, have these HFs regularly query and index data and forward to your Splunk indexer(s). Then just use normal Splunk queries to search the data. This has the downside of using Splunk Enterprise License (as you are now indexing data into Splunk), but a potential upside of adding indirection between your search head users and your database. (Obviously, you'd need the network paths open to either forward data, or search across remote Splunk indexers instead of the database connections).

[a212830]

Nice! Wasn't aware that was possible. Thanks.