Can Universal forwarder, can forward the SQL Table data to splunk?

[mohanmk95]

I am trying to forward the SQL Data to Splunk by using Universal Forwarder...

1. Is it possible to get the data in Splunk without using to SQL DB Connect?
2. if universal forward can forward the data then please share the Configuration.

Please help me to sort this.....!

[niketn]

@mohanmk95 if there is any specific reason for not using SQL DB Connect, try creating scripted input.

A sample script for Microsoft SQL Server connection and data polling is present on Splunk Docs: https://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/ScriptExample

You can create something similar and wrap the same with Splunk Add on Builder

With Universal Forwarder you can only forward SQL performance logs.

[DavidHourani]

Hi @mohanmk95,

Here are the answers to your questions :
1- Is it possible to get the data in Splunk without using to SQL DB Connect?
Yes, if you have scripts dumping your data into files and the configure a Universal Forwarder to read those files and forward the data to your indexers.
2- If universal forward can forward the data then please share the Configuration.
IF you opt for a file dump of your DB then configuration of the UF is pretty simple, it will just be a file monitoring configuration:
https://docs.splunk.com/Documentation/Splunk/latest/Data/Monitorfilesanddirectorieswithinputs.conf

I would advise you to go via a heavy forwarder and pull your DB data into Splunk, it's just easier to maintain, configure and manage.

Cheers,
David

[richgalloway]

The Universal Forwarder can monitor text files, but it cannot monitor SQL databases. Unless you have a third-party utility to export the SQL table to a text file, you'll need DB Connect. DB Connect requires a heavy forwarder.

[VatsalJagani]

Agree with @richgalloway. Not possible without Splunk DB connect or any similar App.

[richgalloway]

I didn't say it isn't possible. It is indeed possible (depends on the flavor SQL), but not with a Universal Forwarder.

[VatsalJagani]

My bad, it's typo it is **without.