Splunk DB Connect includes the opt-in ability to send anonymized usage data to Splunk to help improve the add-on in future releases.
How Splunk DB Connect collects data
If you opt in, the add-on enables an internal library to track basic usage and crash information. The library uses browser cookies to track add-on user visitor uniqueness and sessions and sends events to Splunk using XMLHttpRequest (XHR) in JSON format.
Data Splunk DB Connect collects
If you opt in, Splunk DB Connect sends the following information to Splunk:
- The number of identities you defined on the Splunk platform instance.
- The number of connections you defined on the instance.
- The number of connections associated with each identity on the instance.
- Each connection's database type, whether SSL is enabled, and the connection's associated number of database inputs, outputs, and lookups
- The number of database inputs defined on the instance.
- Each input's type (batch mode or rising column).
- The number of database outputs you defined on the instance.
- The number of database lookups you defined on the instance.
- Whether you enabled search head clustering.
- Each search head's search head cluster mode.
- The daily license usage for each source type that DB Connect defines. DB Connect uses to send daily license usage. You can disable the saved search without harming DB Connect operations.
- The Splunk Enterprise license size.
- The name and version number of every JDBC driver you installed.
- The server roles you defined (provided by the server-roles attribute of the /services/server/info endpoint).
Event | Source type | Description | Data sent includes common fields, plus | ||
---|---|---|---|---|---|
Field | Type | Description | |||
Session start | mint:ping
|
Each ping event indicates that a new session has started. | fsEncrypted
|
N/A | Not used, always "NA" |
rooted
|
N/A | Not used, always false | |||
Session end | mint:gnip
|
Each gnip event indicates that a session has ended. | ses_duration
|
int | How long the session lasted |
Page views | mint:view
|
Triggered once per page view in the app. | current
|
string | The URL of the current web page, without the hostname. |
currentView
|
string | Not used. Hardcoded to 'examples'. | |||
domProcessingTime
|
int | Time spent to process the domain. | |||
domLookupTime
|
int | Time spent to look up the domain name. | |||
elapsedTime
|
int | Time spent to render the page. | |||
host
|
string | The hostname in the URL. | |||
loadTime
|
int | Time spent to load the page. | |||
previous
|
string | The referrer URL. | |||
serverTime
|
int | Time spent to get a response from the server. | |||
App performance and configuration |
mint:log
|
Usage and performance logs for the DB Connect that track dashboard memory usage, dashboard loading times, the number of accounts, inputs, and regions configured in the app, and non-sensitive input configuration parameters. | level
|
int | Log level. For example, 60 means 'error'. |
log_name
|
any | Log content. See examples below. | |||
API calls | mint:network
|
XMLHTTPRequest calls, usually HTTP API calls from client side (browser) to the Splunk server. | failed
|
boolean | Indicates if the request failed or not. |
latency
|
int | Time spent before response received. | |||
protocol
|
string | Network protocol: either http or https. | |||
requestLength
|
string | N/A. Not used. | |||
responseLength
|
int | The size of the response. | |||
statusCode
|
string | HTTP response code. | |||
url
|
string | The request URL, without the hostname. |
Common fields
The data that the DB Connect sends to Splunk, if enabled, includes the following common fields. This set of fields includes several fields that are disabled or deliberately not used for the DB Connect for purposes of anonymization.
Field | Type | Description | Example value |
---|---|---|---|
apiKey
|
string | MINT API key for the DB Connect
|
4t2fk73n |
appRunningState
|
Field is unused by the SDK. Shows a value of "NA" in all events. | ||
appVersionCode
|
Field is unused by the SDK. Shows a value of "NA" in all events. | ||
appVersionName
|
string | The version name of the app sending data. | 4.1.0 |
browser
|
string | The browser name. | Chrome |
browserVersion
|
string | The browser version. | 47.0.2526.111 |
carrier
|
Field is unused by the SDK. Shows a value of "NA" in all events. | ||
connection
|
Field is unused by the SDK. Shows a value of "NA" in all events. | ||
device
|
string | The device making the request. | MacIntel |
extraData
|
JSON object | This field stores custom information for the app. This app uses extraData.splunk_version to store the version number of the Splunk platform instance.
|
6.3.1511 |
locale
|
string | The user locale set in the browser. | en-US |
osVersion
|
string | The version code of the underlying operating system. | OS X 10.11.2 |
packageName
|
string | The package name of the DB Connect. | splunk_app_db_connect |
platform
|
Not used for the DB Connect. Shows a value of "web" in all events. | ||
remoteIP
|
Not used for the DB Connect. Shows a value of "3.0.0.0" in all events. | ||
sdkVersion
|
string | The version of the SDK. | 4.3 |
screenOrientation
|
Field is unused by the SDK. Shows a value of "NA" in all events. | ||
session_id
|
string | A unique string to identify a session. | a5026251 |
state
|
string | Indicator of whether the browser is online or not. Can be either CONNECTED or DISCONNECTED. | CONNECTED |
uuid
|
UUID | A random identifier to track the user's uniqueness | 837227ea-4569-4675-9a17-ccb39ca69505 |
Example app performance and configuration events
DB Connect sends performance and configuration information using the log_name
field in the mint:log
source type. This log_name
field contains two sub-fields, name
, which indicates which type of logs are being transmitted, and data
, the content of the tracking log.
There are three possible options for name
:
track_performance
. When a user accesses a dashboard in the app, DB Connect sends performance logs for dashboard memory usage and loading times.track_configuration
. When a Splunk admin visits the Configure page, DB Connect sends a log of the number of accounts, inputs, and regions configured in the app, and non-sensitive input configuration parameters.track_usage
. When a Splunk admin visits the Configure page, DB Connect sends a log of the data volume that each input is responsible for.
The following examples demonstrate what data the DB Connect sends for each type of event.
log_name.name
|
Example JSON object |
---|---|
track_performance
|
{ "memory":{ "totalJSHeapSize":72200000, "usedJSHeapSize":39600000, "jsHeapSizeLimit":1620000000 }, "timing":{ "navigationStart":1453273923766, "unloadEventStart":1453273923929, "unloadEventEnd":1453273923930, "redirectStart":0, "redirectEnd":0, "fetchStart":1453273923766, "domainLookupStart":1453273923766, "domainLookupEnd":1453273923766, "connectStart":1453273923766, "connectEnd":1453273923766, "secureConnectionStart":0, "requestStart":1453273923773, "responseStart":1453273923927, "responseEnd":1453273923929, "domLoading":1453273923939, "domInteractive":1453273923975, "domContentLoadedEventStart":1453273923975, "domContentLoadedEventEnd":1453273923975, "domComplete":1453273926985, "loadEventStart":1453273926985, "loadEventEnd":1453273926987 } } |
track_configuration
|
{ "identities": { "count": 7, "data": [ { "connections_count": 1 }, { "connections_count": 1 }, { "connections_count": 0 }, { "connections_count": 1 }, { "connections_count": 2 }, { "connections_count": 6 }, { "connections_count": 1 } ] }, "connections": { "count": 12, "data": [ { "connection_type": "db2", "jdbcUseSSL": false, "inputs_count": 0, "outputs_count": 0, "lookups_count": 0 }, { "connection_type": "informix", "jdbcUseSSL": false, "inputs_count": 0, "outputs_count": 0, "lookups_count": 0 }, { "connection_type": "memsql", "jdbcUseSSL": false, "inputs_count": 0, "outputs_count": 0, "lookups_count": 0 }, { "connection_type": "generic_mssql", "jdbcUseSSL": false, "inputs_count": 0, "outputs_count": 0, "lookups_count": 0 }, { "connection_type": "mssql_jtds_win_auth", "jdbcUseSSL": false, "inputs_count": 0, "outputs_count": 0, "lookups_count": 0 }, { "connection_type": "mysql", "jdbcUseSSL": false, "inputs_count": 4, "outputs_count": 2, "lookups_count": 3 }, { "connection_type": "mysql", "jdbcUseSSL": false, "inputs_count": 0, "outputs_count": 0, "lookups_count": 0 }, { "connection_type": "mysql", "jdbcUseSSL": false, "inputs_count": 0, "outputs_count": 0, "lookups_count": 0 }, { "connection_type": "mysql", "jdbcUseSSL": false, "inputs_count": 0, "outputs_count": 0, "lookups_count": 0 }, { "connection_type": "oracle", "jdbcUseSSL": false, "inputs_count": 0, "outputs_count": 1, "lookups_count": 1 }, { "connection_type": "oracle", "jdbcUseSSL": true, "inputs_count": 0, "outputs_count": 0, "lookups_count": 0 }, { "connection_type": "postgres", "jdbcUseSSL": false, "inputs_count": 0, "outputs_count": 0, "lookups_count": 0 } ] }, "drivers": { "count": 0, "data": [] }, "inputs": { "count": 4, "data": [ { "mode": "batch" }, { "mode": "rising" }, { "mode": "batch" }, { "mode": "rising" } ] }, "outputs": { "count": 3, "data": [ { "transactional": true, "is_saved_search": false }, { "transactional": true, "is_saved_search": false }, { "transactional": true, "is_saved_search": false } ] }, "lookups": { "count": 4, "data": [ { "input_fields_count": 0, "output_fields_count": 0 }, { "input_fields_count": 0, "output_fields_count": 0 }, { "input_fields_count": 0, "output_fields_count": 0 }, { "input_fields_count": 0, "output_fields_count": 0 } ] }, "serverstatus": { "count": 1, "data": [ { "isSHCluster": false, "javaVersion": "1.8.0_92" } ] } } |
track_usage
|
{ "usage": [ { "time": "2017-06-21", "volumes": { "sakila_city_rising_input": "0" } }, { "time": "2017-06-22", "volumes": { "sakila_city_rising_input": "0" } }, { "time": "2017-06-23", "volumes": { "sakila_city_rising_input": "0.001021385" } }, { "time": "2017-06-24", "volumes": { "sakila_city_rising_input": "0" } }, { "time": "2017-06-25", "volumes": { "sakila_city_rising_input": "0" } }, { "time": "2017-06-26", "volumes": { "sakila_city_rising_input": "0" } }, { "time": "2017-06-27", "volumes": { "sakila_city_rising_input": "0" } } ] } |
Data DB Connect does not collect
DB Connect does not collect or send the following kinds of data:
- Sensitive data such as usernames or passwords.
- Identifying information such as addresses, phone numbers, IP addresses, or hostnames.
- Indexed data that you ingest into your Splunk platform instance.
DB Connect does not collect any data that is not explicitly described in the Data Splunk DB Connect collects section above.
How to opt in or out
Splunk DB Connect presents an opt-in request the first time that you launch the app. You can also opt in at any time. In Settings, check the box under the Usage Collection tab.
To opt out, leave the box unchecked when the app presents the Help us improve Splunk products and services box. If you previously opted in but want to change your response, uncheck the box at the bottom of the Configure page, and then click Stop sending data. If you opt out after having previously opted in, the app immediately stops sending data to Splunk.
For more information about how Splunk collects and uses data, please refer to the Splunk Privacy Policy.
About Splunk DB Connect | How Splunk DB Connect works |
This documentation applies to the following versions of Splunk® DB Connect: 3.11.0, 3.11.1
Feedback submitted, thanks!