Access Splunk Data from MySQL in PHP

You can use the CData SQL Gateway and ODBC Driver for Splunk to access Splunk data from MySQL clients, without needing to perform an ETL or cache data. Follow the steps below to connect to Splunk data in real time through PHP's standard MySQL interfaces, mysqli and PDO_MySQL.

Connect to Splunk Data

If you have not already done so, provide values for the required connection properties in the data source name (DSN). You can use the built-in Microsoft ODBC Data Source Administrator to configure the DSN. This is also the last step of the driver installation. See the "Getting Started" chapter in the help documentation for a guide to using the Microsoft ODBC Data Source Administrator to create and configure a DSN.

To authenticate requests, set the User, Password, and URL properties to valid Splunk credentials. The port on which the requests are made to Splunk is port 8089.

The data provider uses plain-text authentication by default, since the data provider attempts to negotiate TLS/SSL with the server.

If you need to manually configure TLS/SSL, see Getting Started -> Advanced Settings in the data provider help documentation.

Configure the SQL Gateway

See the SQL Gateway Overview to set up connectivity to Splunk data as a virtual MySQL database. You will configure a MySQL remoting service that listens for MySQL requests from clients. The service can be configured in the SQL Gateway UI.

Connect in PHP

The following examples show how to use object-oriented interfaces to connect and execute queries. Initialize the connection object with the following parameters to connect to the virtual MySQL database:

• Host: Specify the remote host location where the service is running. In this case "localhost" is used for the remote host setting since the service is running on the local machine.
• Username: Specify the username for a user you authorized on the SQL Gateway's Users tab.
• Password: Specify the password for the authorized user account.
• Database Name: Specify the system DSN as the database name.
• Port: Specify the port the service is running on; port 3306 in this example.

mysqli

<?php
$mysqli = new mysqli("localhost", "user", "password", "CData Splunk Sys","3306");
?>

PDO

<?php
$pdo = new PDO('mysql:host=localhost;dbname=CData Splunk Sys;port=3306', 'user', 'password');
?>

Query in PHP

With the connection established, you can then access tables. The following steps walk through the example:

1. Query the table; for example, DataModels. The results will be stored as an associative array in the $result object.
2. Iterate over each row and column, printing the values to display in the PHP page.
3. Close the connection.

mysqli

$result = $mysqli->query("SELECT Name, Owner FROM DataModels");
while($row = $result->fetch_assoc()) {
  foreach ($row as $k=>$v) {
    echo "$k : $v";
    echo "<br>"; 
  }
}
$mysqli->close();

PDO

$result = $pdo->query("SELECT Name, Owner FROM DataModels");
while($row = $result->fetch(PDO::FETCH_ASSOC)) {
  foreach ($row as $k=>$v) {
    echo "$k : $v";
    echo "<br>"; 
  }
}
$result = null;
$pdo = null;