Getting Data In
Highlighted

Can you store data to Splunk without indexing?

Path Finder

I have data coming from MemSQL. Everything is fine with indexing, but I thought would it be possible to store data without indexing.
If so, how that could be done? Suggestions?

0 Karma
Highlighted

Re: Can you store data to Splunk without indexing?

Explorer

You can use DBconnect (which I assume you're already using to index the data) to write your queries inline, then simply output to a lookup or KV store (read from that with inputlookup).

https://docs.splunk.com/Documentation/DBX/3.1.3/DeployDBX/Commands

| dbxquery query="SELECT list,of,desired,columns,here FROM tableName" connection="YourMemSQLConnectionName" maxrows=100
| outputlookup memSQLQuery.csv

Then

| inputlookup memSQLQuery.csv
Highlighted

Re: Can you store data to Splunk without indexing?

SplunkTrust
SplunkTrust

No, it's not.. Splunk's licensing model is based off index volume per day. If you could onboard data without indexing it, then it would upend Splunk's licensing model

0 Karma