Send records from ExtraHop to Google BigQuery
You can configure your Discover appliance to send transaction-level records to a Google BigQuery server for long-term storage, and then query those records from the ExtraHop Web UI and the ExtraHop REST API.
Before you begin
- You need the BigQuery project ID
- You need a credential JSON file from your BigQuery API authentication page
Note: | Any triggers configured to send records through commitRecord to an Explore appliance are automatically redirected to the BigQuery. No further configuration is required. |
Send records from ExtraHop to BigQuery
Complete this procedure on all connected Command and
Discover appliances.
Important: | If your ExtraHop system includes a Command appliance, configure all appliances with the same recordstore settings or transfer management to manage settings from the Command appliance. |
After your configuration is complete, you can query for
stored records in the ExtraHop Web UI by clicking Records.
Important: | Do not modify or delete the table in BigQuery where the records are stored. Deleting the table deletes all stored records. |
Transfer recordstore settings
If you have a Command appliance connected to your Discover appliances, you can configure and manage the recordstore settings on the Discover appliance, or transfer the management of the settings to the Command appliance. Transferring and managing the recordstore settings on the Command appliance enables you to keep the recordstore settings up to date across multiple Discover appliances.
Recordstore settings are configured for connected
recordstores and do not apply to the Explore appliance.
Thank you for your feedback. Can we contact you to ask follow up questions?