What is the recommended method for Splunk DB Connect: periodically indexing data from the database into Splunk, or querying the database on runtime?

[yanivamram]

Hi,

I wonder what is the recommended method while working with DBX.

Assuming 'high availability database':
- Is it better to periodically Index the data from the Database into Splunk?
- or query the Database on runtime?

Currently, I'm using Splunk with DBX connections to our various databases.
The data from the databases mostly used for Alerting and Dashboards.
Currently, I don't collect the relevant data from the databases into Splunk for few reasons:
- Using Stored Procedures
I use StoredProcedures as an API for my Splunk queries.
So, Splunk is less sensitive for DB Schema changes.
- Splunk Performance\License
The database has enough resources to process my SQL queries.
I don't need to extent my Splunk license - as the Splunk doesn't Index my data.
- Data Duplication
I thought I better keep the data in one place.

Thanks in advance,

[woodcock · Accepted solution]

If you need a series of snapshots of your data, then you have to pull it into Splunk. If not, and your DB can handle the load, let your DB do what it does best and save license by doing the queries just when you need the data for your searches.

[yanivamram]

Thanks for the advice!