topic Re: DB connect query field need to create in splunk data in All Apps and Add-ons

DB connect query field need to create in splunk data

rakesh44 — Tue, 19 Mar 2019 08:44:27 GMT

Hi Friends,

I have DB connect query which runs from 1 to 7th date of every month.

I need one field to be create in splunk data if query is run out of date from 1 to 7th of every month. Suppose query is re-run manually on 8th then it should create one field in splunk data. Could we create such automation in splunk

I required such arrangement as we are trying to compare count of data injected from database with count of data in splunk. I could not use date as field as data keep changing in mili seconds.

Re: DB connect query field need to create in splunk data

lakshman239 — Tue, 19 Mar 2019 10:30:19 GMT

you could have a field say | eval query_runTime = _time in your search , which will populate the time and it can be stored in the index. everytime you run, you will have the time (including ms). would this not help?

Re: DB connect query field need to create in splunk data

rakesh44 — Wed, 20 Mar 2019 09:25:40 GMT

There two things when DB connect query runs it pull data from oracle and put it in splunk Index.
In my case if DB connect query runs it should create one field in splunk Index. Then I would count no fields in splunk.