Is it possible to use SSH to connect Splunk to a MySQL database?

[rfagnoni]

Hello,

I am trying to connect Splunk to a MySQL database, however MYSQL is only listening on localhost. To normally connect, I use an SSH connection first then open the connection to MySQL. Is this possible with Splunk?

[dwaddle · Accepted solution]

Yes and no. Or no and yes...

Splunk (specifically the DB Connect app) cannot natively open an SSH connection and use that to transport the database connection.

BUT

SSH supports tunneling. If there is "something" that is continuously holding open an SSH connection with a defined tunnel, then it's possible you could get Splunk to use the tunnel to reach MySQL on the other system. Something like

while true; do ssh -L 13306:127.0.0.1:3306 user@mysqlserver 'while true; sleep 30; done'; done

This would in theory keep the SSH open indefinitely, enabling you to configure something on your Splunk system to use port 13306 to talk to port 3306 on the other side of the tunnel.

This type of thing is brittle by nature but it can be done.

[jagadeeshm]

Are you using a MYSQL Connector or DBConnect? If yes, it requires exporting the database certificate and importing it into the trust store of the JVM powering the JavaBridge.