Splunk Search

Splunk DB Connect and Neo4j anyone?

Paolo_Prigione
Builder

I am trying to connect to Neo4j using their JDBC driver with no luck.
Has anybody done better than this?

Tags (1)
0 Karma

lekanneer
Loves-to-Learn Lots

Not a DB Connect solution. But I do have created an app on splunkbase to pull data out of Neo4j into Splunk (https://splunkbase.splunk.com/app/5495/). Working on another app that can send Splunk data back to Neo4j (https://splunkbase.splunk.com/app/5508/).

0 Karma

ziegfried
Influencer

Most features of DB Connect won't work with Neo4j since it's using a custom query language, not SQL. The following features most-probably won't work:

  • Simple Database Lookups (Advanced lookups might work by specifying a custom query)
  • Database inputs based on a table (might work by specifying a custom query)
  • dboutput
0 Karma

Paolo_Prigione
Builder

Thanks Ziegfried. As the N4J Jdbc driver states a bunch of sql interfaces (squirrelSQL and others...) which work with varying features, I was just hoping for an easy integration. But I understand it was totally out of scope for DBX.

0 Karma

Damien_Dallimor
Ultra Champion

Haven't tried the JDBC driver, but as an alternative Neo4J has a REST Api.
http://docs.neo4j.org/chunked/milestone/rest-api.html

So you could perhaps try out the REST Modular Input.

Paolo_Prigione
Builder

@Mark, my use cases would be:
1) run a custom, live query on N4J (like DBX's |dbquery or |inputlookup or |inputcsv) and process the results in the pipeline.
2) perform custom lookups;
3) populate N4J with data coming from a splunk search.
The use cases are multiple. E.g.
a)Import the graph of a network and see all impacted -"downstram"- devices in case of failure (a top-down approach);
b)Trace all the connections of the servers for which I have logs and draw their connections (bottom-up approach). This would give me, over time, a precise schema of the services a complex application is using.

0 Karma

markneedham
New Member

@Paolo what problems were you having with the JDBC driver?

Nice idea, even though I would miss the opportunity of lookups, "in-search" query functionality. Also, to be able to
populate Neo4j from splunk searches would be very nice.

Was also curious what you meant here? Could you provide a bit more detail...I might be able to help 🙂

0 Karma

Paolo_Prigione
Builder

Nice idea, even though I would miss the opportunity of lookups, "in-search" query functionality. Also, to be able to populate Neo4j from splunk searches would be very nice. Think about tracing all the net connections of the prod servers with "lsof" scripts and draw the chart of the "live" infrastructure in external tools as well...

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...