Getting Data In

What sourcetype should be used input MySQL data

ti786
Explorer

I am using the DB Connect app to connect to a MYSQL database and input the data from a table.

What sourcetype should I use for MySQL data in the Database Input:

  1. dbmon:kv
  2. dbmon:mkv
  3. or some other?

Also the datetime fields in the MySQL data like "2013-09-24 21:31:13" appear as "1385819882.000" in Splunk - is this format to do with the sourcetype and how can I get Splunk to keep the original format?

0 Karma

lukejadamec
Super Champion

Can you post the splunk\etc\apps\dbx\local\inputs.conf stanza for this MySQL input?

To view the raw data in Splunk you run a search that pulls the data from this input and then table it to _raw

search for MySQL data | table _raw

0 Karma

ti786
Explorer

Is it possible to view the rawdata in Splunk that is returned by a MySQL query run from Splunk?

The MySQL data has some datetime fields like "2013-09-24 21:31:13", but these appear as "1385819882.000" in Splunk - how can I get Splunk to keep the original datetime format?

0 Karma

ti786
Explorer

Is it possible to view the rawdata in Splunk that is returned by a MySQL query run from Splunk?

The MySQL data has some datetime fields like "2013-09-24 21:31:13", but these appear as "1385819882.000" in Splunk - how can I get Splunk to keep the original datetime format?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You'll probably get good results with KV. Experiment in a separate index until you get the results you want.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

If you click on the DB Query button in the DB Connect app you can enter a query and see what would be indexed.

To get the datetime format you want, use CONVERT(datetime, column, 120).

---
If this reply helps you, Karma would be appreciated.
0 Karma

ti786
Explorer

Is it possible to view the rawdata in Splunk that is returned by a MySQL query run from Splunk?

The MySQL data has some datetime fields like "2013-09-24 21:31:13", but these appear as "1385819882.000" in Splunk - how can I get Splunk to keep the original datetime format?

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...