How to get data structure and some data from Splunk?

[kirillchokparov]

Our client has been using Splunk to research logs from IT systems.
I need to make Java-integration with his Splunk. So to do this I need to understand the structure of his data.
For the first visit I would like to get the structure and some data from the client.
I have never worked with Splunk only with databases like Oracle and PostgreSQL.

Is this possible to make some dump from the existing Splunk to get structure of the data? Also it would be nice to have some way to get some data for testing purpose.

[lfedak_splunk]

Hey @kirillchokparov, there's a Slack as well and some of the channels might help: http://splk.it/slack
Have you seen the developer portal? http://dev.splunk.com/
And we have a free intro e-learning course if you want to learn a bit more about Splunk. https://www.splunk.com/view/education/SP-CAAAAH9
Here's info about the Splunk DB Connect app that @richgalloway mentioned: https://splunkbase.splunk.com/app/2686/ you can check out other pre-built apps in Splunkbase

[kirillchokparov]

Thanks @Ifedak. Very usefull information.

[richgalloway · Accepted solution]

Data in Splunk is unstructured (with a couple of exceptions we can ignore for now). One of the distinguishing features of Splunk is a schema is not applied to the data until it is searched. This allows for flexible "schemas" for each use case.

The best way to integrate Splunk with SQL databases is to use the DB Connect app.

You'll have to get test data from your client.

[kirillchokparov]

@richgalloway, good day! Could you please tell what are the ways to get test data from Splunk? Can I somehow export the data from Splunk or I should get source files like CSV, that were added to Splunk by the client previously?

[richgalloway]

Yes, data can be exported from Splunk. Run a search for the desired data then click the Export icon (next to the printer icon).

[kirillchokparov]

Great. That works!

[kirillchokparov]

Thank you.