topic Re: Automate Indexing in All Apps and Add-ons

Automate Indexing

harshavrath — Tue, 22 Apr 2014 15:28:45 GMT

Hi,

I have installed Splunk & dbx in windows platform is there a way by which i can index my Oracle table records every 12 hours.Can i automate my indexing process.

Any video or doc that i can refer.

Any Help is Appreciated,

Thanks.

Re: Automate Indexing

dmaislin_splunk — Tue, 22 Apr 2014 15:31:48 GMT

Part of the default documentation for that app: http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Configuredatabasemonitoring

Re: Automate Indexing

harshavrath — Tue, 22 Apr 2014 15:38:35 GMT

hi did you refer to "Specify query interval"

Re: Automate Indexing

dmaislin_splunk — Tue, 22 Apr 2014 15:43:30 GMT

You can put it in cron format:

0 0 * * *

Would execute your script at 12 am every day of every week of every month.

A cron statement consists of five parts:

minute
hour
day of month
month
day of week

http://code.tutsplus.com/tutorials/scheduling-tasks-with-cron-jobs--net-8800

Re: Automate Indexing

harshavrath — Mon, 28 Sep 2020 16:26:05 GMT

SELECT * FROM table_NM WHERE ROWNUM<=30 AND TRUNC(CREATED_DT) BETWEEN to_date('04-10-2014','mm/dd/yyyy') AND to_date('04-10-2014','mm/dd/yyyy') {{AND $rising_column$ > ?}} ORDER BY CREATED_DT ASC

Re: Automate Indexing

harshavrath — Tue, 22 Apr 2014 15:47:12 GMT

this is the query that i use to index data into splunk

Re: Automate Indexing

harshavrath — Tue, 22 Apr 2014 15:49:35 GMT

if i schedule an cron how will i be able to solve the CREATED_DT issue..?

Re: Automate Indexing

dmaislin_splunk — Tue, 22 Apr 2014 15:50:17 GMT

Does the query work when you test it? Does the data show up in Splunk?

Re: Automate Indexing

dmaislin_splunk — Mon, 28 Sep 2020 16:26:07 GMT

You did not describe the issue. Just import the data into Splunk, leave the order statement off the query and use Splunk command | sort - CREATED_DT_ASC | outputlookup yourlookuptable.csv

Re: Automate Indexing

harshavrath — Mon, 28 Sep 2020 16:26:47 GMT

the query works
SELECT * FROM table_NM WHERE ROWNUM<=30 AND TRUNC(CREATED_DT) BETWEEN to_date('04-10-2014','mm/dd/yyyy') AND to_date('04-10-2014','mm/dd/yyyy') {{AND $rising_column$ > ?}} ORDER BY CREATED_DT ASC
i was able to index data into splunk.

Re: Automate Indexing

dmaislin_splunk — Wed, 23 Apr 2014 13:54:38 GMT

Now just use the outputlookup search command once the data is indexed to create the lookup table with a scheduled job.

Re: Automate Indexing

harshavrath — Wed, 23 Apr 2014 15:00:47 GMT

can you provide an example or link as how to use the outputlookup command.

Re: Automate Indexing

dmaislin_splunk — Wed, 23 Apr 2014 15:10:47 GMT

http://docs.splunk.com/Documentation/Splunk/6.0.3/SearchReference/Outputlookup