I need to run same query in multiple DB servers, is there any option to use same connection to read data from multiple database. any options like to pass the DB server name and port numbers from a look up table to one connection and read the data ?
or do i need to create separate connections for each and every DB servers ?
Most people create one for each. There is a bulk upload/configure option in the latest releases that helps you speed this process up.
You could also use the search commands in conjunction with sub searches or the map command, etc. to do something like this:
search that creates a field of db connection names space separated called connectionNames
| mvexpand connectionNames
| map search=“|dbxquery connection=$connectionNames$ query=your query”
| additional SPL commands to make it like you want
| collect index=yourIndex
See the dbxquery command syntax here for other options:
http://docs.splunk.com/Documentation/DBX/3.1.3/DeployDBX/Commands