Getting Data In

Is it possible to use SSH to connect Splunk to a MySQL database?

rfagnoni
Engager

Hello,

I am trying to connect Splunk to a MySQL database, however MYSQL is only listening on localhost. To normally connect, I use an SSH connection first then open the connection to MySQL. Is this possible with Splunk?

1 Solution

dwaddle
SplunkTrust
SplunkTrust

Yes and no. Or no and yes...

Splunk (specifically the DB Connect app) cannot natively open an SSH connection and use that to transport the database connection.

BUT

SSH supports tunneling. If there is "something" that is continuously holding open an SSH connection with a defined tunnel, then it's possible you could get Splunk to use the tunnel to reach MySQL on the other system. Something like

while true; do ssh -L 13306:127.0.0.1:3306 user@mysqlserver 'while true; sleep 30; done'; done

This would in theory keep the SSH open indefinitely, enabling you to configure something on your Splunk system to use port 13306 to talk to port 3306 on the other side of the tunnel.

This type of thing is brittle by nature but it can be done.

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

Yes and no. Or no and yes...

Splunk (specifically the DB Connect app) cannot natively open an SSH connection and use that to transport the database connection.

BUT

SSH supports tunneling. If there is "something" that is continuously holding open an SSH connection with a defined tunnel, then it's possible you could get Splunk to use the tunnel to reach MySQL on the other system. Something like

while true; do ssh -L 13306:127.0.0.1:3306 user@mysqlserver 'while true; sleep 30; done'; done

This would in theory keep the SSH open indefinitely, enabling you to configure something on your Splunk system to use port 13306 to talk to port 3306 on the other side of the tunnel.

This type of thing is brittle by nature but it can be done.

jagadeeshm
Contributor

Are you using a MYSQL Connector or DBConnect? If yes, it requires exporting the database certificate and importing it into the trust store of the JVM powering the JavaBridge.

0 Karma
Get Updates on the Splunk Community!

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...