Splunk Search

how to prepare db_output in advance

boromir
Path Finder

Hi all,

 

So here is the deal, I have to prepare some( a lot) db_outputs(using db_connect), however the corresponding tables are not yet existing. Colleagues responsible for that are on different tasks. I would like to configure the exports in advance, so that once the tables are ready, the output would just flow. (and I might not be able to work on that later) 

I did not manage to find a way using the GUI for that , as it always requires every step of the the way to be fulfilled, so even if I had data waiting for me, I would not be able to prep the field matching. So my idea is to configure them in db_outputs.conf, then a restart of the HF, should (or at least i think) be the solution.

However, there is this....

customized_mappings = <string>
# required
# Specifies the output data name (fieldx) and database column number (1...n) mappings.
# The expected format is:
#   field1:column1:type1,field2:column2:type2,…,fieldN:columnN:typeN

And I do not know where to get the values for the types( I already know what field will be varchar, timestamp etc.... what I do not know is numeric representation of the field types).

So it is a two fold question,

1) does anybody know this numeric to field type mapping (for example varchar=12, unassigned integer=4.... these I got from previous tables) ?

2) has anyone configured outputs in advance, before the corresponding table is even created, and does it start later automatically? 

have fun!

rd

Labels (3)
0 Karma
Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...