Getting Data In

Can Universal forwarder, can forward the SQL Table data to splunk?

mohanmk95
Loves-to-Learn

I am trying to forward the SQL Data to Splunk by using Universal Forwarder...

  1. Is it possible to get the data in Splunk without using to SQL DB Connect?
  2. if universal forward can forward the data then please share the Configuration.

Please help me to sort this.....!

0 Karma

niketn
Legend

@mohanmk95 if there is any specific reason for not using SQL DB Connect, try creating scripted input.

A sample script for Microsoft SQL Server connection and data polling is present on Splunk Docs: https://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/ScriptExample

You can create something similar and wrap the same with Splunk Add on Builder

With Universal Forwarder you can only forward SQL performance logs.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

DavidHourani
Super Champion

Hi @mohanmk95,

Here are the answers to your questions :
1- Is it possible to get the data in Splunk without using to SQL DB Connect?
Yes, if you have scripts dumping your data into files and the configure a Universal Forwarder to read those files and forward the data to your indexers.
2- If universal forward can forward the data then please share the Configuration.
IF you opt for a file dump of your DB then configuration of the UF is pretty simple, it will just be a file monitoring configuration:
https://docs.splunk.com/Documentation/Splunk/latest/Data/Monitorfilesanddirectorieswithinputs.conf

I would advise you to go via a heavy forwarder and pull your DB data into Splunk, it's just easier to maintain, configure and manage.

Cheers,
David

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The Universal Forwarder can monitor text files, but it cannot monitor SQL databases. Unless you have a third-party utility to export the SQL table to a text file, you'll need DB Connect. DB Connect requires a heavy forwarder.

---
If this reply helps you, Karma would be appreciated.
0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Agree with @richgalloway. Not possible without Splunk DB connect or any similar App.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I didn't say it isn't possible. It is indeed possible (depends on the flavor SQL), but not with a Universal Forwarder.

---
If this reply helps you, Karma would be appreciated.
0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

My bad, it's typo it is **without.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...