All Apps and Add-ons

Can Splunk decompress the payload stored in a database and make it in text format as part of pulling the data?

amit97ee354
Explorer

We have integrated systems from app tier to the Databse where the run-time data (including the payload) at the App tier are stored in the DB. The component which pushes data to the DB is developed by DBA group. That component is compressing the payload data before pushing to the DB. When we connect to the DB, I just see ****binary**** as the payload column data. The application team is asking whether Splunk has a capability to decompress the payload and make it in text format as a part of pulling the data.

Are there any plugins available to perform the following?
o Takes a byte array as input
o Uses the .NET’s DefalateStream to do decompress for the given input array and result is de-compressed byte array
o Convert ‘De-compressed Byte array’ to String
o Returns the String

Appreciate your help and response if you have run into the similar kind of situation and/or have a solution for this problem

0 Karma

woodcock
Esteemed Legend

You need to use a scripted input to convert the binary payload to text:

http://docs.splunk.com/Documentation/Splunk/6.3.1/AdvancedDev/ScriptedInputsIntro

Once you get that working, to abstract away the guts, make it modular input:

http://docs.splunk.com/Documentation/Splunk/6.3.1/AdvancedDev/Modinputsintro

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...