Getting Data In

How can I import data from MySQL tables into Splunk assets ?


I have some data in MySQL , and I have DB Content in Splunk.

Now I want import MySQL data into Splunk assets , but I just find how import data from csv files .


I knew this documentation : Collect and extract asset and identity data in Splunk Enterprise Security - Splunk Documentation  , but I don't know how "Use Splunk DB Connect" for import data .



And , this page is null (v7.0.1) : Define identity formats - Splunk Documentation 


PS: Sorry for my bad English.

Labels (1)
Tags (1)
0 Karma


@KleeJean - I don't know if there is any better way to do this, but here is what will work for sure.

  • Install DB Connect on the same search head as Enterprise Security. - 
  • Create a scheduled report (keep intervals according to how often you think data in the database is getting changed.)


| dbxquery query="<write-your-query-here>" connection="<dbx-connection>" 
| outputlookup my_sql_data.csv​


  • Use my_sql_data.csv file as an Enterprise Security asset file.


I hope this helps!!!

0 Karma


Splunk DB Connect is an app that can read data from a SQL database.  Download it from splunkbase and install it on a search head or heavy forwarder.  Documentation for DB Connect is at

If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...