Getting Data In

Getting data splunked arriving over a network/database

jigarkb
Engager

Here are some specific queries/problem statement I have :

  1. How can data be directly fed into splunk in a programmatic manner? This would mean that there is no manual intervention. A scenario is that data is arriving over the network and it needs to be stored in splunk.
  2. Is there a splunk connector which can directly talk to mysql database so that splunk can retrieve data automatically from mysql?
  3. Can the splunk query response data be formatted in JSON? What other formats can splunk query response data be formatted in?
Tags (1)
0 Karma
1 Solution

Ayn
Legend
  1. Yes. This is the most common way of feeding data into Splunk. Manually adding data is (I believe) less common. Filesystem-based inputs will continually monitor files or directories for new data and index it as soon as it arrives. Network-based inputs will do the same for network sockets.

  2. Yes. Have a look at Splunk DB Connect.

  3. Yes. JSON is one, CSV another, and there are more formats available, too. See information in the REST API docs:

View solution in original post

Ayn
Legend
  1. Yes. This is the most common way of feeding data into Splunk. Manually adding data is (I believe) less common. Filesystem-based inputs will continually monitor files or directories for new data and index it as soon as it arrives. Network-based inputs will do the same for network sockets.

  2. Yes. Have a look at Splunk DB Connect.

  3. Yes. JSON is one, CSV another, and there are more formats available, too. See information in the REST API docs:

Ayn
Legend

No, that covers more than what I'd like to put in a simple answer. My suggestion is that you read the docs and become familiar with how Splunk works in a distributed environment.

0 Karma

jigarkb
Engager

Can you explain in detail how to feed xml data coming over a network and feeding it into splunk?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...