Getting Data In

Splunk DB connect: How does it work when storing/indexing data?

jesusgalloEMC
Explorer

Hello community,

First of all, thank you for reading this question.
I am being asked to monitor a new data source (ServiceNow) to track our Incident and Change tickets for ITIL purposes.

The way to go with ServiceNow is DB connect and I am a newbie using DB connect, so in order to calculate license required and storage, I would like to understand by asking the following question:

ServiceNow offers both syslog and DB connection to retrieve the Incidents and Change tickets fields and we are interested in how opened the ticket, assignee group, description, blah, blah blah.

What are the advantages of doing it DB instead of SYSLog and vice-versa?
Is the same indexing ratio and licensing/storage consumption doing it in DB connect than Syslog? or it varies?
Which one will you go and why?

Thank you!

Tags (3)
0 Karma

rakesh44
Communicator

DB connect will not only pull logs from any database and search data but also it can push changes back to Database from splunk , this is major difference.
Also in DB connect license utilisation concept remains same

0 Karma

felipesewaybric
Contributor

For what i use, DB Connect is to read data from Bases like Oracle, Mysql, etc. After the first config. you can use searchs like:

| dbquery "DB-NAME" "select * from dual"

And you can even summary those informations, so when you need to run a query in the DB and save that info in a csv file or a index.

Now syslog is just data being indexed to your splunk, it affects the license and you can read it from a index.

index=my_syslog | table *

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...