I have DB_Connect running only on the Heavy Forwarder. (Got that working)
I want to get a single value from a database (A Date Value), store it in the KV-Store on the Heavy Forwarder (I know how to do that)
I want that Key/Value to be available to both of my (non-clustered) Search Heads. - HOW TO DO THIS?
To clarify a bit. I want to put this value in a dashboard and don't want the query run directly from it.
1. I don't want search heads accessing the database
2. This should also yield somewhat better dashboard performance.
Would like the process to be something like this:
Scheduled DBXQuery Updates K/Value on HF | HF Replicates K/Value to Search Heads | Dashboard Queries K/Value
https://splunkbase.splunk.com/app/3519/
Use that as an alert action on the the HF. Send to a kvstore on the SH.
Your search would simply be an inputlookup of the HF local lookup table with the alert action attached.
https://splunkbase.splunk.com/app/3519/
Use that as an alert action on the the HF. Send to a kvstore on the SH.
Your search would simply be an inputlookup of the HF local lookup table with the alert action attached.
Awesome, this appears to be the missing link.
100% working, thank you!