Implementing Splunk 7, Third Edition - Third Edition

Consuming logs from a database

Some applications are built to store their logs in a database. This has the advantage that the logs are centralized, but the disadvantage that it is difficult to scale beyond the limits of the database server. If the logs are pulled into Splunk, it is possible to take advantage of the Splunk interface and correlate these events with other logs.

The process to consume database logs is essentially as follows:

1. Build the query to retrieve the appropriate events; something as follows:

select date, id, log from log_table 

2. Identify the field that you will use as your pointer. This is usually either an id field or a date field.
3. Modify the query to use this pointer field; use something such as the following code: ...