Getting Data In

Is it possible to use SSH to connect Splunk to a MySQL database?

Engager

Hello,

I am trying to connect Splunk to a MySQL database, however MYSQL is only listening on localhost. To normally connect, I use an SSH connection first then open the connection to MySQL. Is this possible with Splunk?

1 Solution

SplunkTrust
SplunkTrust

Yes and no. Or no and yes...

Splunk (specifically the DB Connect app) cannot natively open an SSH connection and use that to transport the database connection.

BUT

SSH supports tunneling. If there is "something" that is continuously holding open an SSH connection with a defined tunnel, then it's possible you could get Splunk to use the tunnel to reach MySQL on the other system. Something like

while true; do ssh -L 13306:127.0.0.1:3306 user@mysqlserver 'while true; sleep 30; done'; done

This would in theory keep the SSH open indefinitely, enabling you to configure something on your Splunk system to use port 13306 to talk to port 3306 on the other side of the tunnel.

This type of thing is brittle by nature but it can be done.

View solution in original post

SplunkTrust
SplunkTrust

Yes and no. Or no and yes...

Splunk (specifically the DB Connect app) cannot natively open an SSH connection and use that to transport the database connection.

BUT

SSH supports tunneling. If there is "something" that is continuously holding open an SSH connection with a defined tunnel, then it's possible you could get Splunk to use the tunnel to reach MySQL on the other system. Something like

while true; do ssh -L 13306:127.0.0.1:3306 user@mysqlserver 'while true; sleep 30; done'; done

This would in theory keep the SSH open indefinitely, enabling you to configure something on your Splunk system to use port 13306 to talk to port 3306 on the other side of the tunnel.

This type of thing is brittle by nature but it can be done.

View solution in original post

Contributor

Are you using a MYSQL Connector or DBConnect? If yes, it requires exporting the database certificate and importing it into the trust store of the JVM powering the JavaBridge.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!