Splunk DB Connect: is this possible to add/update data to DB from Search-Head (in SH cluster Env)

[pargupta1234]

I am planning to use DB-connect in my workflow. Right now all our lookups lie on SH nodes. 

I want to add/update processed data to DB from SH nodes (in a clustered env) . Is this possible to do so using dbxoutput command ?

NOTE :processed data is created  from some intermediate lookups which lie on SH nodes

[gcusello]

Hi @pargupta1234,

yes it's possible using DB-Connect and giving the correct grants to the user.: you can run all the queries you want, also add/update quesries.

But put very much attention to this because it isn't a security best practice!

I usually avoid to give add/update grants to Splunk users.

Ciao.

Giuseppe