Deployment Architecture

Query SQL DB and ingest results to index?

bpitts2
Path Finder

We have a system that stores very valuable data into a SQL database. I'd rather not ingest the entire DB (because it's huge). I'm wondering what strategy I should go with to get just the results of a specific query.

Let's say for example I want to index the the results of something like:

SELECT Count(*)
FROM sample_table
WHERE date > '2015-10-03 00:00:00'

I'd like to do this on an hourly interval. So I was thinking, I could write a script using sqlcmd such as:

sqlcmd -S theServer-d thisDB -E -Q "SELECT Count(*) FROM sample_table WHERE date > '2015-10-03 00:00:00'" -o "SQLOut.txt"

Then I would setup a monitor on that file.

Is there a less rube goldberg way of doing this, maybe using DB Connect 2?

Thanks in advance!

Tags (1)
0 Karma
1 Solution

muebel
SplunkTrust
SplunkTrust

Yup, DB Connect is absolutely the way to go with this. You can setup a database input that will basically "tail" a query on the DB, indexing new results as they are found.

View solution in original post

muebel
SplunkTrust
SplunkTrust

Yup, DB Connect is absolutely the way to go with this. You can setup a database input that will basically "tail" a query on the DB, indexing new results as they are found.

Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...