DBX. SQL database extension for Splunk. Siegfried Puchbauer

Transcription

1 DBX SQL database extension for Splunk Siegfried Puchbauer

2 Agenda Features Architecture Supported platforms Supported databases Roadmap

3 Features Database connection management SQL database input (content monitoring) SQL database lookups New Splunk commands Database query Database info (Table schema information) Database output (beta feature)

4 Managing database connections Splunk Manager UI extension Auto-completion Instant validation of connection information New configuration file database.conf Supports layering (like other Splunk config files) Automatically encrypts passwords

5 Splunk Manager UI for managing database connections

6 Database monitoring Database input Different kinds on how to monitor Tail based on increasing column values (like timestamp or sequential identifier) Dump periodic snapshots Change observe changes based on cryptographic checksums Batch records deleted when indexed by Splunk Specify table/view to monitor or Specify a custom SQL statement Different output formats

7 Add a new database monitor via Splunk Manager UI

8 Database lookups Manage via Splunk Manager UI Specify table/view or custom SQL statement Usage via Splunk s lookup command High performance Caching Connection pooling

9 Add a new database lookup via Splunk Manager UI

10 New Splunk commands dbquery <database-spec> <sql-statement> [limit=<limit-n>] Performs the given SQL query and returns the results Emits Splunk results Update or create static lookup tables in Splunk Drive dashboard elements from database data dbinfo database=<database-spec> [table=<table-spec>] (tables columns) Fetches schema information from the database

11 New Splunk commands (beta) dboutput type=<insert update> database=<database> table=<table> [fields ] Create, update or delete database records based on information from Splunk searches Batch updates SQL data-type awareness Simple mode Update content by simply specifying the table name and fields/columns Advanced mode Allows the user to specify the SQL statement template

12 DBX Architecture Java-based bridge for broad DBMS support and performance

13 Splunk Java Bridge technology Java Bridge Server Efficient Python to Java communication via local network connection Eliminates JVM startup time Concurrent execution of tasks Allows caching/pooling of resources Read/write access to Splunk configuration via btool access via REST in development Exposing Java functionality and programs Commands Lookups REST endpoints (EAI) Appserver controllers (splunkweb) Scripts

14 Supported platforms Tested on Linux Mac OSX Windows Server Solaris Java >= 1.6 (Sun JRE or OpenJDK) It will support all platforms Splunk runs on eventually

15 Supported DBMS Out of the box Oracle Database Microsoft SQL Server Sybase PostgreSQL MySQL SQLite H2 HyperSQL Generic ODBC support Support for more DBMS vendors will be added in future versions Users can add their own database types by providing JDBC drivers

16 Roadmap Current version: Aug/Sept 2012 Maintenance release 1.1 Q Database output Database monitor live-preview Database batch and change monitor types MSSQL Server Single-SignOn on Windows Transforms for database inputs Fine-grained permissions model for database connections Dedicated DBX forwarder package for distributed monitoring

17 Demo or Trial Access Contact us for more information: