Getting data splunked arriving over a network/database

[jigarkb]

Here are some specific queries/problem statement I have :

1. How can data be directly fed into splunk in a programmatic manner? This would mean that there is no manual intervention. A scenario is that data is arriving over the network and it needs to be stored in splunk.
2. Is there a splunk connector which can directly talk to mysql database so that splunk can retrieve data automatically from mysql?
3. Can the splunk query response data be formatted in JSON? What other formats can splunk query response data be formatted in?

[Ayn · Accepted solution]

1. Yes. This is the most common way of feeding data into Splunk. Manually adding data is (I believe) less common. Filesystem-based inputs will continually monitor files or directories for new data and index it as soon as it arrives. Network-based inputs will do the same for network sockets.

2. Yes. Have a look at Splunk DB Connect.

3. Yes. JSON is one, CSV another, and there are more formats available, too. See information in the REST API docs:

[Ayn]

No, that covers more than what I'd like to put in a simple answer. My suggestion is that you read the docs and become familiar with how Splunk works in a distributed environment.

[jigarkb]

Can you explain in detail how to feed xml data coming over a network and feeding it into splunk?