Getting Data In

Splunk DB Connect: is this possible to add/update data to DB from Search-Head (in SH cluster Env)

New Member

I am planning to use DB-connect in my workflow. Right now all our lookups lie on SH nodes. 

I want to add/update processed data to DB from SH nodes (in a clustered env) . Is this possible to do so using dbxoutput command ?

NOTE :processed data is created  from some intermediate lookups which lie on SH nodes

Labels (1)
0 Karma


Hi @pargupta1234,

yes it's possible using DB-Connect and giving the correct grants to the user.: you can run all the queries you want, also add/update quesries.

But put very much attention to this because it isn't a security best practice!

I usually avoid to give add/update grants to Splunk users.



0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!