Best way to index MYSQL entry in Splunk as soon as it appears in MYSQL

[sssignals]

Hi Splunk community

I have a MYSQL table where program A writes entries to it. Then program B deletes them after processing them. I want to index MYSQL entries in Splunk as soon as it appears in MYSQL.

I currently am using DB connect but I have not experimented it fully. What is the best way to index MYSQL entry in Splunk for my scenario?

Appreciate your thoughts on this. Many thanks in advance.

[gcusello · Accepted solution]

Hi sssignals.
there are two choices:
you can use DB Connect and use an high check frequence for DB update; this solution has two problems: doesn't fully answer to your question because don't trigger events as soos as executed, but with the frequency you setted; in addition is heavy for the Splunk system and for DB server.

Second solution is heavyer:
you create on DB server a script that triggers events in MYSQL and writes on a file the triggered event; file is monitored by a Forwarder that sends triggered event to Splunk where there is a real time alert.
It's less heavy for Splunk server because a part of activity is performed by the DB Server without an overload for it because it has to execute queries in both the solutions, but need more work to implement (script, Forwarder installation and configuration).

Bye.
Giuseppe