All Apps and Add-ons

Use DBConnect/dbxquery to Populate a Lookup Table having more than a Million Rows

mnm1987
Explorer

Hello Splunkers,
What is the best possible approach to use inorder to build a Lookup table in Splunk which would have more than a Million Rows, the source of which is a Database Table.

I have tried using DbConnect to fetch the data and Index it into Splunk, but to make it usable we end up needing to run a subsearch for all time and also dedup the results. The issue with the above is that 1) Its Slow 2) Sub-Search Needs to run on all time.

Thanks.

0 Karma

woodcock
Esteemed Legend

You could build another system that access the DB and publishes the list on a webserver and use this app:

https://splunkbase.splunk.com/app/635/

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Is this maybe what you are looking for?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...