Splunk Search

How can we index real-time data directly from an Oracle database into splunk?

saurabh7026
Engager

Is there any way to index real-time data directly from an oracle database into the splunk? I want to index data from a database and this will be real-time data.

0 Karma
1 Solution

sbochniewicz
Path Finder

The quick answer is https://splunkbase.splunk.com/app/2686/

This database connection app will let you import, export and lookup oracle data.

The important part is ensuring that the data your are importing has an incremental number or date that can be used to collect only new data.

db-tail is the input feature you are looking for.

View solution in original post

pmdba
Builder

You can also check out this paper for more information on a variety of ways to get Oracle data into Splunk. If you want to report database changes in real-time, then db-tail may not be the best option. db-tail can capture incremental changes, but it still runs like a scheduled job - at most once per minute - and runs a query on your data that will put some minimal additional load on your system. If that is close enough to real-time for you, then it is probably the easiest option.

If you need closer to real-time, then your best bet would be a PL/SQL trigger or some such that would transmit the data directly to Splunk on a TCP input. There is some risk of data being lost that way (if packets were lost on the network or if the trigger failed for some reason) but it would be as close to real-time as you could get. There is an example of how to set this up in the paper.

0 Karma

sbochniewicz
Path Finder

The quick answer is https://splunkbase.splunk.com/app/2686/

This database connection app will let you import, export and lookup oracle data.

The important part is ensuring that the data your are importing has an incremental number or date that can be used to collect only new data.

db-tail is the input feature you are looking for.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...