Deployment Architecture

How to read from 3 different db connect systems?

a212830
Champion

Hi,

We have a set of databases that we want to query using db connect. The db's are in different regions and house the same type of performance data, but for devices local to that region. Is there a way to have db connect read both databases using db query?

Tags (2)
0 Karma
1 Solution

acharlieh
Influencer

If the search head is able to connect to all of them, then yes you can setup database connections to all of them: http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Createandmanagedatabaseconnections

Then just dbxquery connection=connection1 ... | append [dbxquery connection=connection2 ...] | ...

If not, you could also setup DBConnect on a Heavy Forwarder in each region, have these HFs regularly query and index data and forward to your Splunk indexer(s). Then just use normal Splunk queries to search the data. This has the downside of using Splunk Enterprise License (as you are now indexing data into Splunk), but a potential upside of adding indirection between your search head users and your database. (Obviously, you'd need the network paths open to either forward data, or search across remote Splunk indexers instead of the database connections).

View solution in original post

acharlieh
Influencer

If the search head is able to connect to all of them, then yes you can setup database connections to all of them: http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Createandmanagedatabaseconnections

Then just dbxquery connection=connection1 ... | append [dbxquery connection=connection2 ...] | ...

If not, you could also setup DBConnect on a Heavy Forwarder in each region, have these HFs regularly query and index data and forward to your Splunk indexer(s). Then just use normal Splunk queries to search the data. This has the downside of using Splunk Enterprise License (as you are now indexing data into Splunk), but a potential upside of adding indirection between your search head users and your database. (Obviously, you'd need the network paths open to either forward data, or search across remote Splunk indexers instead of the database connections).

View solution in original post

a212830
Champion

Nice! Wasn't aware that was possible. Thanks.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!