PowerShell Scripting to Replicate Splunk Data to MySQL

The CData Cmdlets for Splunk offer live access to Splunk data from within PowerShell. Using PowerShell scripts, you can easily automate regular tasks like data replication. This article will walk through using the CData Cmdlets for Splunk and the CData Cmdlets for MySQL in PowerShell to replicate Splunk data to a MySQL database.

After obtaining the needed connection properties, accessing Splunk data in PowerShell and preparing for replication consists of four basic steps.

To authenticate requests, set the User, Password, and URL properties to valid Splunk credentials. The port on which the requests are made to Splunk is port 8089.

The data provider uses plain-text authentication by default, since the data provider attempts to negotiate TLS/SSL with the server.

If you need to manually configure TLS/SSL, see Getting Started -> Advanced Settings in the data provider help documentation.

Collecting Splunk Data

1. Install the module:

   Install-Module SplunkCmdlets

2. Connect to Splunk:

   $splunk = Connect-Splunk -user $user -password $password -URL $URL

3. Retrieve the data from a specific resource:

   $data = Select-Splunk -Connection $splunk -Table "DataModels"

   You can also use the Invoke-Splunk cmdlet to execute pure SQL-92 statements:

   $data = Invoke-Splunk -Connection $splunk -Query 'SELECT * FROM DataModels WHERE Id = @Id' -Params @{'@Id'='SampleDataset'}

4. Save a list of the column names from the returned data.

   $columns = ($data | Get-Member -MemberType NoteProperty | Select-Object -Property Name).Name

Inserting Splunk Data into the MySQL Database

With the data and column names collected, you are ready to replicate the data into a MySQL database.

1. Install the module:

   Install-Module MySQLCmdlets

2. Connect to MySQL, using the server address and port of the MySQL server, valid user credentials, and a specific database with the table in which the data will be replicated:

   $mysql = Connect-MySQL -User $User -Password $Password -Database $Database -Server $Server -Port $Port

3. Loop through the Splunk data, store the values, and use the Add-MySQL cmdlet to insert the data into the MySQL database, one row at a time. In this example, the table will need to have the same name as the Splunk resource (DataModels) and to exist in the database.

   $data | % { $row = $_ $values = @() $columns | % { $col = $_ $values += $row.$($col) } Add-MySQL -Connection $mysql -Table "DataModels" -Columns $columns -Values $values }

You have now replicated your Splunk data to a MySQL database. This gives you freedom to work with Splunk data in the same way that you work with other MySQL tables, whether that is performing analytics, building reports, or other business functions.

Notes

• Once you have connected to Splunk and MySQL in PowerShell, you can pipe command results to perform the replication in a single line:

  Select-Splunk -Connection $splunk -Table "DataModels" | % { $row = $_ $values = @() $columns | % { $col = $_ $values += $row.$($col) } Add-MySQL -Connection $mysql -Table "DataModels" -Columns $columns -Values $values }

• If you wish to replicate the Splunk data to another database using another PowerShell module, you will want to exclude the Columns, Connection, and Table columns from the data returned by the Select-Splunk cmdlet since those columns are used to help pipe data from one CData cmdlet to another:

  $columns = ($data | Get-Member -MemberType NoteProperty | Select-Object -Property Name).Name | ? {$_ -NotIn @('Columns','Connection','Table')}