topic Re: Splunk DB Connect: Index data running dbxquery command in All Apps and Add-ons

Splunk DB Connect: Index data running dbxquery command

maurelio79 — Mon, 30 Oct 2017 18:45:21 GMT

Hi to all, i'd like to know if it's possible index data running dbx command from a sdk python script.
I'm not finding anything on internet. if i manually run | dbxquery ... data are not indexed, they are indexed just if the query is scheduled via Splunk UI.
Is there a different way? Maybe some rest api? Or maybe running one of the mi script (mi_input.py?) after command dbxquery?

Thanks and regards.

Re: Splunk DB Connect: Index data running dbxquery command

s2_splunk — Mon, 30 Oct 2017 19:02:38 GMT

Did you read through the documentation? Database Inputs are used to index data from a database. The dbxquery search command is used to execute SQL statements or stored procedures.

What is your requirement that you need to execute it from a Python script?
I guess it would be possible to execute a query with dbxquery and then use | collect to store the results in an index, but it would help to better understand your use case.

Re: Splunk DB Connect: Index data running dbxquery command

maurelio79 — Mon, 30 Oct 2017 20:11:33 GMT

Hi, first of all for for answer.
Basically i was asked to give to the customer the possibility to change the scheduled time of db input via beta48 batch on mainframe.
For example: when new data are inserted on DB2, the user schedule a job that change the scheduled time of the DB input, for this reason i was thinking about python.

Thanks and regards.

P.S.
Basically i need to run a DB input on demand, not scheduled.

Re: Splunk DB Connect: Index data running dbxquery command

garias_splunk — Fri, 21 Jun 2019 08:38:40 GMT

Tested!
from the command line, curl command calling saved search that includes a |collect index=yourIndexHere does trigger a search that gets data from DB and index the outcome within yourIndexHere

Re: Splunk DB Connect: Index data running dbxquery command

francisco_mota — Wed, 23 Dec 2020 19:52:37 GMT

Maybe using as bellow:

| dbxquery connection=<YOUR_CONNECTION> query="<YOUR_QUERY>" | collect index=<YOUR_INDEX_NAME>