Splunk Enterprise

Query DBX internal logs for Input and which index, source, souretype its written to

aa70627
Communicator

I know you can search for list of all db connect jobs and when they've ran historically within the internal logs, which gets you how long the query ran, # events and error count. Is there anyway to get which index, source and sourcetype it was written to without having to check on the DB Connection inputs ? For example, I'd like to know where it was written and if anything has changed since it ran? 

index=_internal sourcetype=dbx* status=* input_name

 

 

Labels (1)
0 Karma

aa70627
Communicator

I'm guessing the answer is no. I've taken this with a different approach - using the DB Connect rest api. If anyone knows of a better way for this, please post. Greatly appreciated. 

 

 

| rest  splunk_server=localhost /servicesNS/nobody/splunk_app_db_connect/properties/db_inputs/
| table title, updated
| rename title as dbinput_name 
| join type=left dbinput_name
[| rest  splunk_server=localhost /servicesNS/nobody/splunk_app_db_connect/properties/db_inputs/
    | fields title 
| map search="| rest  splunk_server=localhost /servicesNS/nobody/splunk_app_db_connect/properties/db_inputs/$title$/index|eval dbinput_name = \"$title$\", index=value|table dbinput_name index" maxsearches=400]
| join type=left dbinput_name
[| rest  splunk_server=va10dlvspl301 /servicesNS/nobody/splunk_app_db_connect/properties/db_inputs/
    | fields title 
| map search="| rest  splunk_server=va10dlvspl301 /servicesNS/nobody/splunk_app_db_connect/properties/db_inputs/$title$/sourcetype|eval dbinput_name = \"$title$\", sourcetype=value|table dbinput_name sourcetype" maxsearches=400]

 

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...