Getting Data In

How can I import events from an AWS:RDS PostgreSQL data into a Universal Forwarder?

mlinebarger
Explorer

I have an application on an AWS:EC2 (Linux) instance that uses an AWS:RDS PostgreSQL instance (in the same subnet) to store its key process information and I'd like to pull from that DB table into Splunk for reporting purposes. I already have a Splunk Universal Forwarder installed and running on the EC2 instance; is it possible to get data from the RDS DB into the EC2 forwarder to pass on to the "splunkcloud" indexer(s)? Any help would be greatly appreciated.

0 Karma
1 Solution

mlinebarger
Explorer

I think I may have just found my own answer... searching through Splunk docs, I see that there is no direct "monitoring" of DB tables and, therefore, a forwarder (such as the "Universal Forwarder" that I have set up) cannot gather data from a DB to pass on to an indexer. However, there is an add-on to Splunk Enterprise ("Splunk DB Connect") that will "import tables, rows, and columns from a database directly into Splunk Enterprise, which indexes the data". I will be talking to our Splunk administrator to see if we can get this add-on implemented. Wish us luck; it should do what we want.

View solution in original post

rohith17992
New Member

,I am having a concern regarding situation where a multiple DB's should be connected to splunk (Database logs should go to splunk), however this is possible with the universal forwarder but here I am not using the enterprise splunk where it is not showing DB connect or under DATA except(Report acceleration summaries) drop down settings bar on the top right in a commercial splunk console, In this case how can I install the forwarder to configure it with the RDS in the environment to draw the DB logs to go to splunk? What procedure I can able to follow to send the DB logs to go to splunk with no admin rights or by the commercial splunk. any suggestions are much appreciated.

0 Karma

mlinebarger
Explorer

I think I may have just found my own answer... searching through Splunk docs, I see that there is no direct "monitoring" of DB tables and, therefore, a forwarder (such as the "Universal Forwarder" that I have set up) cannot gather data from a DB to pass on to an indexer. However, there is an add-on to Splunk Enterprise ("Splunk DB Connect") that will "import tables, rows, and columns from a database directly into Splunk Enterprise, which indexes the data". I will be talking to our Splunk administrator to see if we can get this add-on implemented. Wish us luck; it should do what we want.

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...