pushing splunk results automatically

[riderofyamaha]

I have a question regarding having specific splunk data that is automatically searched for exported to a different database automatically. not much information i know, but i cant think of how else to ask, thanks for your input

[riderofyamaha]

thank you, very helpfull

[Lowell]

You may want to check SplunkMSE. See the Splunk MySQL Storage Engine blog entry for additional info.

[hulahoop · Accepted solution]

I can think of 3 ways to accomplish this:

1. Scripted Alert - setup a schedule search which kicks off a script to write the results of the search to a database. Splunk will schedule and execute the search, pass the search results to the script, and the script will handle the DB connection and write. This would be completely automated. How to create a scripted alert.

2. Custom Search Command - create a Splunk search command which can be used inline on the search bar with any search. Use the search command just like you would the fields, top, stats commands. For example, your search would call this new command like this: ... | export2DB. This calls a python script on the backend to handle the actual DB connection and writes. How to create a custom search command.

3. Event-Level Workflow - add an option in the event drop-down menu to write the event to the DB. This is similar to the first 2 options, but operates on a per-event basis rather than the entire result set. How to create a workflow action.

I hope this gives you some options. Let us know how you proceed.