Getting Data In

Is it possible to use SSH to connect Splunk to a MySQL database?

rfagnoni
Engager

Hello,

I am trying to connect Splunk to a MySQL database, however MYSQL is only listening on localhost. To normally connect, I use an SSH connection first then open the connection to MySQL. Is this possible with Splunk?

1 Solution

dwaddle
SplunkTrust
SplunkTrust

Yes and no. Or no and yes...

Splunk (specifically the DB Connect app) cannot natively open an SSH connection and use that to transport the database connection.

BUT

SSH supports tunneling. If there is "something" that is continuously holding open an SSH connection with a defined tunnel, then it's possible you could get Splunk to use the tunnel to reach MySQL on the other system. Something like

while true; do ssh -L 13306:127.0.0.1:3306 user@mysqlserver 'while true; sleep 30; done'; done

This would in theory keep the SSH open indefinitely, enabling you to configure something on your Splunk system to use port 13306 to talk to port 3306 on the other side of the tunnel.

This type of thing is brittle by nature but it can be done.

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

Yes and no. Or no and yes...

Splunk (specifically the DB Connect app) cannot natively open an SSH connection and use that to transport the database connection.

BUT

SSH supports tunneling. If there is "something" that is continuously holding open an SSH connection with a defined tunnel, then it's possible you could get Splunk to use the tunnel to reach MySQL on the other system. Something like

while true; do ssh -L 13306:127.0.0.1:3306 user@mysqlserver 'while true; sleep 30; done'; done

This would in theory keep the SSH open indefinitely, enabling you to configure something on your Splunk system to use port 13306 to talk to port 3306 on the other side of the tunnel.

This type of thing is brittle by nature but it can be done.

jagadeeshm
Contributor

Are you using a MYSQL Connector or DBConnect? If yes, it requires exporting the database certificate and importing it into the trust store of the JVM powering the JavaBridge.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...