If we have database connectors set up in Splunk, can we create data models using database queries?

[hkosuru]

Hello,

We have database connectors set up in Splunk to run database queries. Can you create Data Models using database queries?

Thanks,
Bindu

[niemesrw]

I'm not entirely sure what you're trying to do here, but we have done the following:

1. use db connect and run sql query to dump out hashes of files detected by symantec (sql database)
2. db connect populates an index=detected_hashes
3. created CIM-compatible fields mapping the database fields to the inventory datamodel (inventory datamodel has constraint=detected_hashes)
4. inventory datamodel can be queried to return information in the detected_hashes index

all DM commands (like acceleration) work fine.

[muebel]

you using db connect v1 or v2?

[hkosuru]

currently using v1. planning to move to v2