topic Splunk DB Connect 2: What is the proper syntax for dbxquery? in All Apps and Add-ons

Splunk DB Connect 2: What is the proper syntax for dbxquery?

kbecker — Tue, 07 Apr 2015 14:50:23 GMT

With DBConnect v2, it looks like dbquery was replaced with dbxquery, however, the syntax doesn't appear to be documented. Looking at the python command code, I see it needs a connection and query argument, however, when these are supplied, the search just runs. This same SQL query works fine from the SQL query page and with DBConnect v1.

| dbxquery connection=CONNECTION query=QUERY

I tried no quotes, single quotes, and double quotes around the SQL query

Re: Splunk DB Connect 2: What is the proper syntax for dbxquery?

kbecker — Thu, 16 Apr 2015 02:44:25 GMT

I have found dbxquery does work. The downside is you have to replace spaces and special characters with the hex equivalent (See below)...

| dbxquery connection=XYZ query="SELECT%20Location,%20NodeID,%20Caption,%20Description,%20IP_Address%20FROM%20MyTable%20WHERE%20(Caption%20LIKE%20%27%-P0%%27)%20OR%20(Caption%20LIKE%20%27%A0%%27)"

Re: Splunk DB Connect 2: What is the proper syntax for dbxquery?

jcoates_splunk — Sat, 18 Apr 2015 15:06:25 GMT

this is going to be corrected in a future release. In the meantime, you can use urlencode tools or sites to get it right (note that it's got to replace space with %20, not -).

Re: Splunk DB Connect 2: What is the proper syntax for dbxquery?

BP9906 — Wed, 29 Apr 2015 21:29:00 GMT

I confirm this works, major bummer on this since Splunk has no easy urlencode function, only urldecode.
I plan to use dbxquery for a long dynamic SQL query but I'll have to wait for this to be fixed because I have PullDown modules sending variables and encoding the query partially in URL Encoded format wont suffice.

Re: Splunk DB Connect 2: What is the proper syntax for dbxquery?

araitz — Tue, 12 May 2015 22:32:07 GMT

you%20can%27t%20read%20url%20encoded%20strings%3F!%3F

Re: Splunk DB Connect 2: What is the proper syntax for dbxquery?

peter7431 — Wed, 08 Jul 2015 12:59:30 GMT

Any ideas when this will be corrected?

Re: Splunk DB Connect 2: What is the proper syntax for dbxquery?

ashish_ray — Wed, 29 Jul 2015 00:18:23 GMT

"dbxquery" command is working in DBconnect ver-2 not in DB-connect =< ver-1.1.7 that I have tested.

The command syntax is bit awkward any space need to reconverted hex-code:

Working command:
| dbxquery query="SELECT%20*%20FROM%20customers" connection="Northwind_products"

Re: Splunk DB Connect 2: What is the proper syntax for dbxquery?

rutgerthomschut — Thu, 10 Sep 2015 20:24:39 GMT

@jcoates_splunk any news on when DB Connect v2 queries won't require to be URL encoded any longer?

Re: Splunk DB Connect 2: What is the proper syntax for dbxquery?

landen99 — Wed, 13 Jan 2016 21:13:05 GMT

It has been corrected. Spaces work fine.