DBX SQL database extension for Splunk Siegfried Puchbauer
Agenda Features Architecture Supported platforms Supported databases Roadmap
Features Database connection management SQL database input (content monitoring) SQL database lookups New Splunk commands Database query Database info (Table schema information) Database output (beta feature)
Managing database connections Splunk Manager UI extension Auto-completion Instant validation of connection information New configuration file database.conf Supports layering (like other Splunk config files) Automatically encrypts passwords
Splunk Manager UI for managing database connections
Database monitoring Database input Different kinds on how to monitor Tail based on increasing column values (like timestamp or sequential identifier) Dump periodic snapshots Change observe changes based on cryptographic checksums Batch records deleted when indexed by Splunk Specify table/view to monitor or Specify a custom SQL statement Different output formats
Add a new database monitor via Splunk Manager UI
Database lookups Manage via Splunk Manager UI Specify table/view or custom SQL statement Usage via Splunk s lookup command High performance Caching Connection pooling
Add a new database lookup via Splunk Manager UI
New Splunk commands dbquery <database-spec> <sql-statement> [limit=<limit-n>] Performs the given SQL query and returns the results Emits Splunk results Update or create static lookup tables in Splunk Drive dashboard elements from database data dbinfo database=<database-spec> [table=<table-spec>] (tables columns) Fetches schema information from the database
New Splunk commands (beta) dboutput type=<insert update> database=<database> table=<table> [fields ] Create, update or delete database records based on information from Splunk searches Batch updates SQL data-type awareness Simple mode Update content by simply specifying the table name and fields/columns Advanced mode Allows the user to specify the SQL statement template
DBX Architecture Java-based bridge for broad DBMS support and performance
Splunk Java Bridge technology Java Bridge Server Efficient Python to Java communication via local network connection Eliminates JVM startup time Concurrent execution of tasks Allows caching/pooling of resources Read/write access to Splunk configuration via btool access via REST in development Exposing Java functionality and programs Commands Lookups REST endpoints (EAI) Appserver controllers (splunkweb) Scripts
Supported platforms Tested on Linux Mac OSX Windows Server Solaris Java >= 1.6 (Sun JRE or OpenJDK) It will support all platforms Splunk runs on eventually
Supported DBMS Out of the box Oracle Database Microsoft SQL Server Sybase PostgreSQL MySQL SQLite H2 HyperSQL Generic ODBC support Support for more DBMS vendors will be added in future versions Users can add their own database types by providing JDBC drivers
Roadmap 1.0.3 1.1 2.0 Current version: 1.0.2 1.0.3 Aug/Sept 2012 Maintenance release 1.1 Q3 2012 Database output Database monitor live-preview Database batch and change monitor types MSSQL Server Single-SignOn on Windows Transforms for database inputs 2.0 2013 Fine-grained permissions model for database connections Dedicated DBX forwarder package for distributed monitoring
Demo or Trial Access Contact us for more information: splunk@spp.at