Getting Data In

Splunk to integrate 2 third party systems without indexing the data

nareshinsvu
Builder

Is there a way to use splunk to extract data from a SQL DB and send it (using Heavy Forwarder?) as a csv to a remote share without indexing the actual data? - I don't want to see any of the data in Splunk. Rather use Splunk as a integration tool.

Is this possible? Any successful use-cases will help me to implement this.

TA,
Naresh

0 Karma

martynoconnor
Communicator

If the HF has the appropriate inputs file to gather the data, you can write a search to format the data as a table, and then use the outputcsv search command which will dump a csv of the results on disk. You could then use a script to check for new csvs and scp them to where you need them as and when required. You could also ask the HF to send uncooked data to the third party system but it would send each file line by line so you'd need to reconstruct at the other end.

0 Karma

ivanreis
Builder

As far as I know, Splunk is capable to forward raw/parsed data to 3rd party systems, but not in csv file format before indexing.
The Splunk DB connect app is capable to connect to a SQL database and extract data to splunk for indexing. As the Splunk DB connect app have to be deployed at Splunk Heavy forwarder tier, I believe you can use props and transforms config file to route data to a 3rd party system before indexing them.

for further information about forwarding data to 3rd party systems -> https://docs.splunk.com/Documentation/Splunk/8.0.0/Forwarding/Routeandfilterdatad

for further information about DB connect -> https://docs.splunk.com/Documentation/DBX/3.2.0/DeployDBX/AboutSplunkDBConnect

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...