Splunk DB Connect and Neo4j anyone?

[Paolo_Prigione]

I am trying to connect to Neo4j using their JDBC driver with no luck.
Has anybody done better than this?

[lekanneer]

Not a DB Connect solution. But I do have created an app on splunkbase to pull data out of Neo4j into Splunk (https://splunkbase.splunk.com/app/5495/). Working on another app that can send Splunk data back to Neo4j (https://splunkbase.splunk.com/app/5508/).

[ziegfried]

Most features of DB Connect won't work with Neo4j since it's using a custom query language, not SQL. The following features most-probably won't work:

• Simple Database Lookups (Advanced lookups might work by specifying a custom query)
• Database inputs based on a table (might work by specifying a custom query)
• dboutput

[Paolo_Prigione]

Thanks Ziegfried. As the N4J Jdbc driver states a bunch of sql interfaces (squirrelSQL and others...) which work with varying features, I was just hoping for an easy integration. But I understand it was totally out of scope for DBX.

[Damien_Dallimor]

Haven't tried the JDBC driver, but as an alternative Neo4J has a REST Api.
http://docs.neo4j.org/chunked/milestone/rest-api.html

So you could perhaps try out the REST Modular Input.

[Paolo_Prigione]

@Mark, my use cases would be:
1) run a custom, live query on N4J (like DBX's |dbquery or |inputlookup or |inputcsv) and process the results in the pipeline.
2) perform custom lookups;
3) populate N4J with data coming from a splunk search.
The use cases are multiple. E.g.
a)Import the graph of a network and see all impacted -"downstram"- devices in case of failure (a top-down approach);
b)Trace all the connections of the servers for which I have logs and draw their connections (bottom-up approach). This would give me, over time, a precise schema of the services a complex application is using.

[markneedham]

@Paolo what problems were you having with the JDBC driver?

Nice idea, even though I would miss the opportunity of lookups, "in-search" query functionality. Also, to be able to
populate Neo4j from splunk searches would be very nice.

Was also curious what you meant here? Could you provide a bit more detail...I might be able to help 🙂

[Paolo_Prigione]

Nice idea, even though I would miss the opportunity of lookups, "in-search" query functionality. Also, to be able to populate Neo4j from splunk searches would be very nice. Think about tracing all the net connections of the prod servers with "lsof" scripts and draw the chart of the "live" infrastructure in external tools as well...