Getting Data In

Can you store data to Splunk without indexing?

Path Finder

I have data coming from MemSQL. Everything is fine with indexing, but I thought would it be possible to store data without indexing.
If so, how that could be done? Suggestions?

0 Karma


No, it's not.. Splunk's licensing model is based off index volume per day. If you could onboard data without indexing it, then it would upend Splunk's licensing model

0 Karma


You can use DBconnect (which I assume you're already using to index the data) to write your queries inline, then simply output to a lookup or KV store (read from that with inputlookup).

| dbxquery query="SELECT list,of,desired,columns,here FROM tableName" connection="YourMemSQLConnectionName" maxrows=100
| outputlookup memSQLQuery.csv


| inputlookup memSQLQuery.csv
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...