How can I associate and display uncollected user data from a DB2 server with user data collected and parsed in Splunk??

[jkoepsell]

Hello,

When performing a search, can Splunk perform a DB2 database lookup of uncollected user data, associate it with logged user data and display both logged and unlogged user data in the search results? Could somebody please explain how I go about doing this? For example, we have Splunk currently set to log a subset of user information data: UserName and ContractNumber. When performing a search in Splunk, we would like the results to associate additional user data contained in our DB2 server (e.g., FirstName & LastName), with the data collected by Splunk and display all data in the search results (e.g., UserName, ContractNumber, FirstName & LastName).

Can anybody point me in the direction of any tutorials, sample queries / programs or sagely Splunk gurus out there that can help figure this out?

[tgow]

You can use the lookup command in your search string. Splunk can execute the SQL to pull the data out of your DB2 database but it is recommended that you do this in a separate script outside of Splunk. Run the SQL script against the DB2 DB and put the data into a .csv file and Splunk can read it via the lookup commdand.

Here is a link to examples.

http://www.splunk.com/base/Documentation/4.1.5/Knowledge/Addfieldsfromexternaldatasources#Set_up_a_f...

Hope this helps.