Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Deployment Architecture
- :
- How to read from 3 different db connect systems?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If the search head is able to connect to all of them, then yes you can setup database connections to all of them: http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Createandmanagedatabaseconnections
Then just dbxquery connection=connection1 ... | append [dbxquery connection=connection2 ...] | ...
If not, you could also setup DBConnect on a Heavy Forwarder in each region, have these HFs regularly query and index data and forward to your Splunk indexer(s). Then just use normal Splunk queries to search the data. This has the downside of using Splunk Enterprise License (as you are now indexing data into Splunk), but a potential upside of adding indirection between your search head users and your database. (Obviously, you'd need the network paths open to either forward data, or search across remote Splunk indexers instead of the database connections).
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If the search head is able to connect to all of them, then yes you can setup database connections to all of them: http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Createandmanagedatabaseconnections
Then just dbxquery connection=connection1 ... | append [dbxquery connection=connection2 ...] | ...
If not, you could also setup DBConnect on a Heavy Forwarder in each region, have these HFs regularly query and index data and forward to your Splunk indexer(s). Then just use normal Splunk queries to search the data. This has the downside of using Splunk Enterprise License (as you are now indexing data into Splunk), but a potential upside of adding indirection between your search head users and your database. (Obviously, you'd need the network paths open to either forward data, or search across remote Splunk indexers instead of the database connections).
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Nice! Wasn't aware that was possible. Thanks.
Community Content Calendar, September edition
Splunkbase Unveils New App Listing Management Public Preview
Leveraging Automated Threat Analysis Across the Splunk Ecosystem
