topic Re: Syntax for dboutput in All Apps and Add-ons

Syntax for dboutput

richgalloway — Wed, 22 May 2013 17:39:13 GMT

I'm attempting to update a MySQL table using dboutput. I have an output stanza defined to simplify my searches. If I use the following search command where 'myupdate' is my output stanza name:

...| dboutput myUpdate IPAddress NetAddress ComputerName Manufacturer Model

I get this error message:

"Error in 'dboutput' command: command="dboutput", Missing mandatory option: type (Usage: dboutput ([dboutput-stanza] | type=<insert|update> database=<database> table=<table> [notFound=<ignore|fail|insert>] (<field> [as column]|*)+) )"

It would seem I am not specifying dboutput-stanza correctly. Can anyone set me straight? Or is this a bug in dboutput?

Re: Syntax for dboutput

cramasta — Thu, 23 May 2013 17:08:07 GMT

you need to list as the fields like below. I believe it works like field1(name in splunk results) AS field1(column name in db)

| dboutput type=insert database=mydb table=mytable key=somekey field1 AS field1 field2 AS field2

Re: Syntax for dboutput

richgalloway — Thu, 23 May 2013 17:38:21 GMT

Thanks, cramasta, but I think I wasn't clear about my problem. The dboutput usage string says it takes either an output-stanza name or a set of arguments (type, database, etc.). I'm trying to do the former and it's not being accepted.

Re: Syntax for dboutput

richgalloway — Fri, 11 Oct 2013 12:12:23 GMT

The dboutput command changed in DBX 1.1 to not allow output stanzas. The complete syntax is now documented in http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Commands#dboutput.