{"id":19306,"date":"2020-08-26T12:57:24","date_gmt":"2020-08-26T12:57:24","guid":{"rendered":"https:\/\/merikebi.warrenmyers.com\/?p=19306"},"modified":"2020-08-26T12:57:24","modified_gmt":"2020-08-26T12:57:24","slug":"answer-by-warren-for-splunk-execute-the-same-query-on-multiple-datasources","status":"publish","type":"post","link":"https:\/\/merikebi.warrenmyers.com\/?p=19306","title":{"rendered":"Answer by warren for Splunk: Execute the same query on multiple datasources"},"content":{"rendered":"<p>The only way Splunk has to connect to a database &quot;itself&quot; is via <a href=\"https:\/\/splunkbase.splunk.com\/app\/2686\/#\/details\" rel=\"nofollow noreferrer\">DB Connect<\/a> (<a href=\"https:\/\/docs.splunk.com\/Documentation\/DBX\/3.3.1\/DeployDBX\/AboutSplunkDBConnect\" rel=\"nofollow noreferrer\">docs<\/a>)<\/p>\n<p><em>From Splunk&#8217;s perspective<\/em>, there is no way to connect to 100 databases without having unique connections to each.<\/p>\n<p>So far as I know, there is no tool that will connect to more than one database without unique connections &#8211; that&#8217;s something database servers enforce in transactional models.<\/p>\n<p>That being said, if you have a way to enumerate all the databases you want to connect to, and a place to save the queries you want to run, you could build either a<\/p>\n<ul>\n<li><a href=\"https:\/\/docs.splunk.com\/Documentation\/Splunk\/latest\/AdvancedDev\/ScriptedInputsIntro\" rel=\"nofollow noreferrer\">scripted-input<\/a> add-on that could use your language of choice (whatever&#8217;s available on the Splunk server(s)\/endpoint(s) it&#8217;s running on) to iterate through each database, run each query, and ship the results back to Splunk, or<\/li>\n<li>in similar fashion to the scripted-input option, write a script (or set of scripts) that would execute the queries in question against the databases you&#8217;re targeting, and submit results to the <a href=\"https:\/\/docs.splunk.com\/Documentation\/Splunk\/8.0.5\/Data\/HECExamples\" rel=\"nofollow noreferrer\">HTTP Event Collector<\/a> (<a href=\"https:\/\/dev.splunk.com\/enterprise\/docs\/devtools\/httpeventcollector\/\" rel=\"nofollow noreferrer\">HEC<\/a>) (HL has a great write-up on HEC over <a href=\"https:\/\/www.hurricanelabs.com\/splunk-tutorials\/how-to-set-up-splunk-hec-the-right-way\" rel=\"nofollow noreferrer\">here<\/a>, and here&#8217;s George Starcher&#8217;s <a href=\"https:\/\/github.com\/georgestarcher\/Splunk-Class-httpevent\" rel=\"nofollow noreferrer\">Python class<\/a> for HEC)<\/li>\n<\/ul>\n<p>from User warren &#8211; Stack Overflow https:\/\/stackoverflow.com\/questions\/63593286\/splunk-execute-the-same-query-on-multiple-datasources\/63597983#63597983<br \/>\nvia <a href=\"https:\/\/ifttt.com\/?ref=da&#038;site=wordpress\">IFTTT<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>The only way Splunk has to connect to a database &quot;itself&quot; is via DB Connect (docs) From Splunk&#8217;s perspective, there is no way to connect to 100 databases without having unique connections to each. So far as I know, there is no tool that will connect to more than one database without unique connections &#8211; &hellip;<br \/><a href=\"https:\/\/merikebi.warrenmyers.com\/?p=19306\" class=\"more-link pen_button pen_element_default pen_icon_arrow_double\">Continue reading <span class=\"screen-reader-text\">Answer by warren for Splunk: Execute the same query on multiple datasources<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[4],"tags":[991],"keyring_services":[],"class_list":["post-19306","post","type-post","status-publish","format-standard","hentry","category-blih","tag-stackexchange"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/19306","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=19306"}],"version-history":[{"count":1,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/19306\/revisions"}],"predecessor-version":[{"id":19307,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/19306\/revisions\/19307"}],"wp:attachment":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=19306"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=19306"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=19306"},{"taxonomy":"keyring_services","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fkeyring_services&post=19306"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}