Getting Data In

Can Universal forwarder, can forward the SQL Table data to splunk?

mohanmk95
Observer

I am trying to forward the SQL Data to Splunk by using Universal Forwarder...

  1. Is it possible to get the data in Splunk without using to SQL DB Connect?
  2. if universal forward can forward the data then please share the Configuration.

Please help me to sort this.....!

0 Karma

@mohanmk95 if there is any specific reason for not using SQL DB Connect, try creating scripted input.

A sample script for Microsoft SQL Server connection and data polling is present on Splunk Docs: https://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/ScriptExample

You can create something similar and wrap the same with Splunk Add on Builder

With Universal Forwarder you can only forward SQL performance logs.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

DavidHourani
Super Champion

Hi @mohanmk95,

Here are the answers to your questions :
1- Is it possible to get the data in Splunk without using to SQL DB Connect?
Yes, if you have scripts dumping your data into files and the configure a Universal Forwarder to read those files and forward the data to your indexers.
2- If universal forward can forward the data then please share the Configuration.
IF you opt for a file dump of your DB then configuration of the UF is pretty simple, it will just be a file monitoring configuration:
https://docs.splunk.com/Documentation/Splunk/latest/Data/Monitorfilesanddirectorieswithinputs.conf

I would advise you to go via a heavy forwarder and pull your DB data into Splunk, it's just easier to maintain, configure and manage.

Cheers,
David

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The Universal Forwarder can monitor text files, but it cannot monitor SQL databases. Unless you have a third-party utility to export the SQL table to a text file, you'll need DB Connect. DB Connect requires a heavy forwarder.

---
If this reply helps you, Karma would be appreciated.
0 Karma

VatsalJagani
Champion

Agree with @richgalloway. Not possible without Splunk DB connect or any similar App.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I didn't say it isn't possible. It is indeed possible (depends on the flavor SQL), but not with a Universal Forwarder.

---
If this reply helps you, Karma would be appreciated.
0 Karma

VatsalJagani
Champion

My bad, it's typo it is **without.

0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...