All Apps and Add-ons

How do I configure DB Connect to Forward Events

jakesony
Explorer

Hi,

I'm sure there is an easy answer to this. I have installed DB Connect on a search head and have it configured to watch a particular table. Setup saves without errors and I can see that the polling is active in dbx.log

I want to forward the events that DBC is picking up to my indexers. How do I do that? I don't want the search head to index the events itself, I just want to forward them on.

Thanks

0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

You need to configure an outputs.conf on your machine to forward to the indexers. Once you have an outputs.conf set up correctly, the instance will forward accordingly. It's okay to do this on a search head if load is light, but I would suggest you consider having a dedicated Splunk forwarder instance instead for collecting the data and then forwarding it.

(Do not simply enable your search head with the Forwarder or LightForwarder app. This will let you collect and forward data, yes, but it will also do things like disable the GUI that you would not want to happen on a search head.)

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

You need to configure an outputs.conf on your machine to forward to the indexers. Once you have an outputs.conf set up correctly, the instance will forward accordingly. It's okay to do this on a search head if load is light, but I would suggest you consider having a dedicated Splunk forwarder instance instead for collecting the data and then forwarding it.

(Do not simply enable your search head with the Forwarder or LightForwarder app. This will let you collect and forward data, yes, but it will also do things like disable the GUI that you would not want to happen on a search head.)

jakesony
Explorer

Thank you. Works. I had only configured UFs before, so I was unsure what to do configuring the search head to forward.

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

Hi. It depends how you want to use the data... For instance, if you want it to be a lookup, you could outputlookup and then let Splunk take care of the rest.

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

I see. You need to configure an input then, http://docs.splunk.com/Documentation/DBX/1.0.10/DeployDBX/inputsspec

0 Karma

jakesony
Explorer

The data that I'm trying to extract from the DB is log data. I would like to see when I search in Splunk just like other events that I'm indexing.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...