When SQL set data is sent to Splunk via sql scripts, do you use sql syntax or do you utilize Splunk query linguistics?

[reneedeleon]

This is just a question for my learning.  When SQL set data is sent to Splunk via sql scripts, do you use sql syntax or do you utilize Splunk query linguistics? and can you format your rows and columns in the same manner? I'm crowd sourcing to better build my report. 

[inventsekar]

Hi @reneedeleon .. You can use the DBConnect app to ingest data from a SQL to Splunk.. it will use a SQL to select the data as per your requirements.. and then once data got ingested to Splunk, you can use the Splunk SPL for report creation.. Please check the documentation:

https://docs.splunk.com/Documentation/DBX/3.9.0/DeployDBX/HowSplunkDBConnectworks

[reneedeleon]

Awesome @inventsekar I will give this a try. I was definitely concerned as I have only dealt with data in Splunk as it is ingested in a CEF format. Utilizing SQL scripts for data ingestion is a new format for me. Thank you.