This is a question I am going to provide the answer to, I am curious how other sites have setup DB Connect for a large number of database connections.
The application has a nice interface and editing the configuration files is relatively straightforward, but I found the RESTful interface of Splunk particularly useful for DB Connect setup as I can create the identities, connections and inputs I need without clicking any buttons or editing files locally...
If anyone has an alternative/nicer solution feel free to provide alternative answers...
The information provided below relates to Splunk DB Connect V2, for Splunk DB Connect V3 refer to https://answers.splunk.com/answers/516111/splunk-db-connect-v3-automated-programmatic-creati.html#an...
The Splunk managing objects tutorial http://dev.splunk.com/view/managing-objects-tutorial/SP-CAAADQ5 covers the basics of the REST API, the part that I didn't know was where to access the URL:
https://localhost:8089/servicesNS/nobody/splunk_app_db_connect/
Allows access to the RESTful interface of the application, from here there are a few services in particular I found useful:
curl -k -u admin:changeme http://localhost:8089/servicesNS/nobody/splunk_app_db_connect/db_connect/identities/ -d "connection_type=oracle_service" -d "name=OracleTesting" -d "password=XXXX" -d "username=OracleUsername"
curl -k -u admin:changeme http://localhost:8089/servicesNS/nobody/splunk_app_db_connect/db_connect/connections -d "connection_type=oracle_service" -d "name=OracleTesting" -d "host=OracleHost" -d "database=OracleDB" -d "identity=OracleTesting"
curl -k -u admin:changeme http://localhost:8089/services/search/jobs/export -d search="| dbxquery query=\"alter user OracleUser identified by password replace oldpassword\" connection=\"OracleTesting\""
http://localhost:8089/servicesNS/nobody/splunk_app_db_connect/data/inputs/mi_input
Is the URL required to create a new input, there are a number of parameters to be passed in here which are well described in the service.
Good luck!
Is there a way to UPDATE an identity? I've been searching but coming up empty.
The information provided below relates to Splunk DB Connect V2, for Splunk DB Connect V3 refer to https://answers.splunk.com/answers/516111/splunk-db-connect-v3-automated-programmatic-creati.html#an...
The Splunk managing objects tutorial http://dev.splunk.com/view/managing-objects-tutorial/SP-CAAADQ5 covers the basics of the REST API, the part that I didn't know was where to access the URL:
https://localhost:8089/servicesNS/nobody/splunk_app_db_connect/
Allows access to the RESTful interface of the application, from here there are a few services in particular I found useful:
curl -k -u admin:changeme http://localhost:8089/servicesNS/nobody/splunk_app_db_connect/db_connect/identities/ -d "connection_type=oracle_service" -d "name=OracleTesting" -d "password=XXXX" -d "username=OracleUsername"
curl -k -u admin:changeme http://localhost:8089/servicesNS/nobody/splunk_app_db_connect/db_connect/connections -d "connection_type=oracle_service" -d "name=OracleTesting" -d "host=OracleHost" -d "database=OracleDB" -d "identity=OracleTesting"
curl -k -u admin:changeme http://localhost:8089/services/search/jobs/export -d search="| dbxquery query=\"alter user OracleUser identified by password replace oldpassword\" connection=\"OracleTesting\""
http://localhost:8089/servicesNS/nobody/splunk_app_db_connect/data/inputs/mi_input
Is the URL required to create a new input, there are a number of parameters to be passed in here which are well described in the service.
Good luck!