General question regarding indexing

[vikas_gopal]

Hi Guys,

Please help me to understand how indexing will work if we hit to an external database.For example if I prepare a dashboard from SQL database via "splunk db connect app" then how indexing works.

Regards
Vikas

[richgalloway · Accepted solution]

It's not clear what your looking for. Anything DB Connect reads from a SQL database will be stored in the index specified in DB Connect. The indexing itself works the same as for any other data source.

[richgalloway]

You're right. Without a sourcetype, your SQL data would not be broken out into fields. See if you can change the definition of the DB Connect input to add a sourcetype. If that's not possible, you'll have to parse the _raw yourself using rex.

[vikas_gopal]

even it is not working if I just mentioned | fields date in the search bar I mean how would splunk knows date field from which database and from which table without source or sourcetype ....Not sure if I am clear to you

[richgalloway]

So you can leave the index and sourcetype keywords out of your search since there are no values to use. You'll need to find other criteria to use to narrow your search.

[vikas_gopal]

strange I have one database input and for that sourcetype is "None" and Splunk Index is "default" don't think so if solves my purpose....:(

[richgalloway]

To find the index name, go to Manager->Data Inputs->Database Inputs and you'll see the index for all defined database inputs. You'll also see the sourcetype names which you can put into your search query.

[vikas_gopal]

Thanks Richgalloway,
Thanks for the clarity that indexing works the same for all the data sources. Actually I am not sure which index name specified at the time of DB connect .Is it possible to find out the index name ?

Why I am asking all these basic questions as i want to type a dbquery in Search bar .My dbquery is "| dbquery "databasename" "select date from abc" ".
I want to type it in search bar as
index=?? source=?? sourcetype=?? |fields date