Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- How to setup "Metadata" characteristics in Splunk ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
Finally I have configure my Remote sql server database with splunk using Splunk DB connect V2, but.. in my setup of last step I really don't know what to write(fill in those fields >> http://screencast.com/t/RNqNKkvn ). For your information I have taken the screenshot which will help you to guide me.
http://screencast.com/t/0xxdLo8W > Done Name Input successfully
http://screencast.com/t/sIOhgIVFr > Choose and Preview Table successfully
http://screencast.com/t/OtezGx3nI1 > Set Parameter successfully
http://screencast.com/t/RNqNKkvn > What should I enter here in source and sourcetype?**
From SQL Server I am retrieving the data, which i want to put in the index named "dev_zipcode". This data I needed for my application.
Thanks !!
Awaited for your quick response.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You set them to values that make it easy for you to understand where the data came from (source), and what format it is (sourcetype). So for example, I have a DB input set up where I set source to the name of the database and table, securitylogs_AccountUpdates, and I set the sourcetype to securitylogs. I then used the sourcetype to describe how to parse the timestamp in props.conf. That way, if I set up more inputs from other tables in the same database, I can use the same sourcetype so I get all that parsing done the same way.
You might not need any special parsing, so just make sure the values you put in Source and Sourcetype make sense for the future.
Here's some more info on the two concepts:
- Source: http://docs.splunk.com/Splexicon:Source
- Sourcetype: http://docs.splunk.com/Splexicon:Sourcetype
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You set them to values that make it easy for you to understand where the data came from (source), and what format it is (sourcetype). So for example, I have a DB input set up where I set source to the name of the database and table, securitylogs_AccountUpdates, and I set the sourcetype to securitylogs. I then used the sourcetype to describe how to parse the timestamp in props.conf. That way, if I set up more inputs from other tables in the same database, I can use the same sourcetype so I get all that parsing done the same way.
You might not need any special parsing, so just make sure the values you put in Source and Sourcetype make sense for the future.
Here's some more info on the two concepts:
- Source: http://docs.splunk.com/Splexicon:Source
- Sourcetype: http://docs.splunk.com/Splexicon:Sourcetype
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks Laserval.
I will do the needful as you suggested.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello Friends, Please help me to solve this issue..
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...
Best Practices: Splunk auto adjust pipeline queue
