How to connect Splunk to a mySQL ODBC database source.


This setup guide assumes that you followed our last guide on how to setup Splunk and how to setup a ODBC connection to a mySQL database
http://webaj.com/how-setup-splunk-monitoring-zenoss-logs.htm
http://webaj.com/how-setup-linux-connecting-mysql-datasbase-source-myodbc-and-unixodbc.htm

Make sure you can connect to your database via ODBC.
isql -v zenoss root BlAh
If not read our article on how to setup ODBC connections in Linux

Everything is done via the web GUI so open up FireFox and access the Splunk web interface.
http://localhost:8000 <----- I am ssh tunneling.

Select "Admin"

"Data Inputs"

"Database Table Inputs"


"Add Input" on the far right.


This is from our ODBC setup guide, your DSN and Table may be differnt.

Select "Add"

Now if you go back to the main Splunk page you will see your "Sources" count is up by one and "db-input" is the DSN you just added.

Your done, you can add as many tables as you want but first you must set them up via ODBC. There seems to be a bug where DSN do not show under the admin souces but you are able to Splunk them.

Next we will be covering how to secure the open source version of Splunk with a username and password via Apache authication and how to make Splunk start when you turn the sytem on.