Splunk Search

how to reduce SQL connections from splunk to oracle DB for good performance?

sagar0907
Engager

we are building various dashboards for monitoring purpose. Most of the dashboards need the data from database, which we are fetching by connection to database using DBXQuery. initially the panels on the dashboard were populating Quickly but later on due to increased DB connection everything got slower. Now we are trying to reduce the connections to Database as the Queries are affecting performance of other procedures in database.
i wanted to know that is there any way to reduce connection either by storing the sql o/p(which gives different result on each run) or by using the dump files of the table?
i really need to reduce the sql connections from Splunk

Tags (1)
0 Karma

somesoni2
Revered Legend

It'll depend on the type of db query you run (query fetches real-time data or historical), how frequently the database gets updated and how data is stored in tables (do they've timestamp or primary key). Based on feasibility you can setup database inputs to fetch the data periodically to index the data into Splunk, either as a daily/hourly dump OR using a rising column if your data stored a transactional data. This way you'll query the database once and can fire the dashboards many times with indexed data.

sagar0907
Engager

this is what i am looking for,can you please provide the link for the documentation( if available) for fetching the data periodically (hourly in my case), i would like to implement this.

0 Karma

somesoni2
Revered Legend
0 Karma

sagar0907
Engager

i tried to follow the steps and have created an data input wit frequency 1m(for testing) and index as bip( unaware what to chose) . after finishing the set up i tried to search in the app ( search & reporting same as mentioned in settings while creating input) i am unable to get any events or data.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...