All Apps and Add-ons

How do I configure DB Connect to Forward Events

jakesony
Explorer

Hi,

I'm sure there is an easy answer to this. I have installed DB Connect on a search head and have it configured to watch a particular table. Setup saves without errors and I can see that the polling is active in dbx.log

I want to forward the events that DBC is picking up to my indexers. How do I do that? I don't want the search head to index the events itself, I just want to forward them on.

Thanks

0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

You need to configure an outputs.conf on your machine to forward to the indexers. Once you have an outputs.conf set up correctly, the instance will forward accordingly. It's okay to do this on a search head if load is light, but I would suggest you consider having a dedicated Splunk forwarder instance instead for collecting the data and then forwarding it.

(Do not simply enable your search head with the Forwarder or LightForwarder app. This will let you collect and forward data, yes, but it will also do things like disable the GUI that you would not want to happen on a search head.)

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

You need to configure an outputs.conf on your machine to forward to the indexers. Once you have an outputs.conf set up correctly, the instance will forward accordingly. It's okay to do this on a search head if load is light, but I would suggest you consider having a dedicated Splunk forwarder instance instead for collecting the data and then forwarding it.

(Do not simply enable your search head with the Forwarder or LightForwarder app. This will let you collect and forward data, yes, but it will also do things like disable the GUI that you would not want to happen on a search head.)

View solution in original post

jakesony
Explorer

Thank you. Works. I had only configured UFs before, so I was unsure what to do configuring the search head to forward.

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

Hi. It depends how you want to use the data... For instance, if you want it to be a lookup, you could outputlookup and then let Splunk take care of the rest.

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

I see. You need to configure an input then, http://docs.splunk.com/Documentation/DBX/1.0.10/DeployDBX/inputsspec

0 Karma

jakesony
Explorer

The data that I'm trying to extract from the DB is log data. I would like to see when I search in Splunk just like other events that I'm indexing.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!