About mlinebarger

mlinebarger · ‎05-29-2015

Actually, you are correct that I am getting the red dot and "RPC Service: Down" message; however, when I click on that, it takes me to a New Search page (with: index=_internal dbx_error ) and "No results found".

mlinebarger · ‎05-29-2015

I have been tasked with creating a Splunk dashboard based on data stored in tables in a PostgreSQL DB located on an AWS:RDS instance. I was encouraged somewhat when I discovered the add-on "Splunk DB Connect v2" and began looking at the documentation. I installed the app on our instance of Splunk and I've been trying to get it to work ever since. Regardless of how I try to set up access to the RDS DB, I continue to get an error (a '!' character on a red triangle) that is meaningless since I do not how to determine what that symbol means. My first question would be: where can I find the details of the error I am seeing? There is no verbiage on the screen explaining the symbol making it difficult to chase down the cause. In the interest of full disclosure, I am using SplunkCloud to manage and display data from our logs. Does anyone know if this app is compatible in this environment? Does anyone have any experience with this app accessing an AWS:RDS instance (particularly PostgreSQL) that could help me get past the connection/access issue above?

mlinebarger · ‎04-10-2015

I think I may have just found my own answer... searching through Splunk docs, I see that there is no direct "monitoring" of DB tables and, therefore, a forwarder (such as the "Universal Forwarder" that I have set up) cannot gather data from a DB to pass on to an indexer. However, there is an add-on to Splunk Enterprise ("Splunk DB Connect") that will "import tables, rows, and columns from a database directly into Splunk Enterprise, which indexes the data". I will be talking to our Splunk administrator to see if we can get this add-on implemented. Wish us luck; it should do what we want.

mlinebarger · ‎04-09-2015

I have an application on an AWS:EC2 (Linux) instance that uses an AWS:RDS PostgreSQL instance (in the same subnet) to store its key process information and I'd like to pull from that DB table into Splunk for reporting purposes. I already have a Splunk Universal Forwarder installed and running on the EC2 instance; is it possible to get data from the RDS DB into the EC2 forwarder to pass on to the "splunkcloud" indexer(s)? Any help would be greatly appreciated.

mlinebarger · ‎04-09-2015

Thanks, Bill... as it turns out, I was wrong about a local instance of Splunk. Instead, our indexers are on "splunkcloud.com" and the solution was rather simple. I was able to install the universal forwarder in my EC2 instance and add an outputs.conf file (with the preconfigured "server=" setting pointing to our indexers) to the "/local" folder under $SPLUNK_HOME. Worked like a charm (with a few other minor tweaks, of course). Thanks to all for the suggestions; I know that they will help in the future as we grow our cloud presence.

mlinebarger · ‎04-06-2015

Thanks, dwaddle, for the quick response. Both solutions are definitely worth considering; the "pros" for both are intriguing, but I can definitely fall into some of the "cons" as well.

mlinebarger · ‎04-06-2015

We have recently moved some of our applications to the AWS cloud and now I am being tasked with: "install and configure Splunk fwder on the necessary instances ( i.e. anything writing a log)". I have found posts to allow for creating a Splunk cluster on AWS, but I believe that this is more than I need. We already have Splunk licensed on a local machine and I am trying to get data, from the logs generated by the apps running on AWS, aggregated with what is already being monitored. Thanks for any help.

Posts	7
Solutions	2
Karma Given	0
Karma Received	5
Member Since	‎04-06-2015

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

How can Splunk DB Connect 2 access an AWS:RDS Post...

How can I import events from an AWS:RDS PostgreSQL...

How can I install a forwarder on an AWS:EC2 instan...

Re: How can Splunk DB Connect 2 access an AWS:RDS ...

How can Splunk DB Connect 2 access an AWS:RDS Post...

Re: How can I import events from an AWS:RDS Postgr...

How can I import events from an AWS:RDS PostgreSQL...

Re: How can I install a forwarder on an AWS:EC2 in...

Re: How can I install a forwarder on an AWS:EC2 in...

How can I install a forwarder on an AWS:EC2 instan...