Splunk Search

How can we index real-time data directly from an Oracle database into splunk?

saurabh7026
Engager

Is there any way to index real-time data directly from an oracle database into the splunk? I want to index data from a database and this will be real-time data.

0 Karma
1 Solution

sbochniewicz
Path Finder

The quick answer is https://splunkbase.splunk.com/app/2686/

This database connection app will let you import, export and lookup oracle data.

The important part is ensuring that the data your are importing has an incremental number or date that can be used to collect only new data.

db-tail is the input feature you are looking for.

View solution in original post

pmdba
Builder

You can also check out this paper for more information on a variety of ways to get Oracle data into Splunk. If you want to report database changes in real-time, then db-tail may not be the best option. db-tail can capture incremental changes, but it still runs like a scheduled job - at most once per minute - and runs a query on your data that will put some minimal additional load on your system. If that is close enough to real-time for you, then it is probably the easiest option.

If you need closer to real-time, then your best bet would be a PL/SQL trigger or some such that would transmit the data directly to Splunk on a TCP input. There is some risk of data being lost that way (if packets were lost on the network or if the trigger failed for some reason) but it would be as close to real-time as you could get. There is an example of how to set this up in the paper.

0 Karma

sbochniewicz
Path Finder

The quick answer is https://splunkbase.splunk.com/app/2686/

This database connection app will let you import, export and lookup oracle data.

The important part is ensuring that the data your are importing has an incremental number or date that can be used to collect only new data.

db-tail is the input feature you are looking for.

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...