Deployment Architecture

Is there a way to propagate dbquery result to all search heads?

joeldavideng
Path Finder

I am running a daily query against an external database that provides a list of assets that many of my searches utilize. The searches exist on multiple search heads and I would like to avoid having to install DB Connect on all of them and replicate the expensive search. Is there a way to have the query run once on a centralized node and then have the others pull this list on a daily basis without having to use the deployment server?

0 Karma
1 Solution

starcher
SplunkTrust
SplunkTrust

Run DBX on a heavy forwarder. Have your query send to a kvstore lookup on the target SHs or SHC using the alert action in: https://splunkbase.splunk.com/app/3519/

View solution in original post

starcher
SplunkTrust
SplunkTrust

Run DBX on a heavy forwarder. Have your query send to a kvstore lookup on the target SHs or SHC using the alert action in: https://splunkbase.splunk.com/app/3519/

joeldavideng
Path Finder

This app is fire. Thanks a lot!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...