All Apps and Add-ons

Use DBConnect/dbxquery to Populate a Lookup Table having more than a Million Rows

mnm1987
Explorer

Hello Splunkers,
What is the best possible approach to use inorder to build a Lookup table in Splunk which would have more than a Million Rows, the source of which is a Database Table.

I have tried using DbConnect to fetch the data and Index it into Splunk, but to make it usable we end up needing to run a subsearch for all time and also dedup the results. The issue with the above is that 1) Its Slow 2) Sub-Search Needs to run on all time.

Thanks.

0 Karma

woodcock
Esteemed Legend

You could build another system that access the DB and publishes the list on a webserver and use this app:

https://splunkbase.splunk.com/app/635/

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Is this maybe what you are looking for?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...