https://community.splunk.com/t5/Getting-Data-In/Importing-HCL-BigFix-data-from-Insights-how-to-verify/m-p/633489#M108449 <P>We are using HCL BigFix and HCL Insights as a data warehouse.&nbsp; There have been times when the import of data from HCL BigFix to HCL Insights has partially failed with no indication a failure has occurred.&nbsp; We would like to verify the HCL Insights data imported into Splunk against the HCL BigFix databases.&nbsp; Is there a way to run SPL that checks what's in Splunk against an external MS SQL database?</P> <P>I know how to create a db connector and setup a read only account.&nbsp; But I don't want to import data from the database, just verify the data already in Splunk.&nbsp;&nbsp;</P> <P>&nbsp;</P> <P>index=patch sourcetype="ibm:bigfix:Patch" | table&nbsp;<SPAN>BigFixDatabasePathTxt&nbsp;ComputerDNSNm&nbsp;ComputerId&nbsp;FixletId&nbsp;FixletIsRelevantInd&nbsp;FixletLastBecameRelevantDtm | join type=inner ComputerId [ | dbxquery query="select&nbsp;BigFixDatabasePathTxt&nbsp;ComputerDNSNm&nbsp;ComputerId&nbsp;FixletId&nbsp;FixletIsRelevantInd&nbsp;FixletLastBecameRelevantDtm from patch where {put SPL output here?}]</SPAN></P> <P><SPAN>We'd like the output to only show unmatched data.</SPAN></P> <P>&nbsp;</P> Tue, 07 Mar 2023 15:25:51 GMT richtate 2023-03-07T15:25:51Z https://community.splunk.com/t5/Getting-Data-In/Importing-HCL-BigFix-data-from-Insights-how-to-verify/m-p/633489#M108449 <P>We are using HCL BigFix and HCL Insights as a data warehouse.&nbsp; There have been times when the import of data from HCL BigFix to HCL Insights has partially failed with no indication a failure has occurred.&nbsp; We would like to verify the HCL Insights data imported into Splunk against the HCL BigFix databases.&nbsp; Is there a way to run SPL that checks what's in Splunk against an external MS SQL database?</P> <P>I know how to create a db connector and setup a read only account.&nbsp; But I don't want to import data from the database, just verify the data already in Splunk.&nbsp;&nbsp;</P> <P>&nbsp;</P> <P>index=patch sourcetype="ibm:bigfix:Patch" | table&nbsp;<SPAN>BigFixDatabasePathTxt&nbsp;ComputerDNSNm&nbsp;ComputerId&nbsp;FixletId&nbsp;FixletIsRelevantInd&nbsp;FixletLastBecameRelevantDtm | join type=inner ComputerId [ | dbxquery query="select&nbsp;BigFixDatabasePathTxt&nbsp;ComputerDNSNm&nbsp;ComputerId&nbsp;FixletId&nbsp;FixletIsRelevantInd&nbsp;FixletLastBecameRelevantDtm from patch where {put SPL output here?}]</SPAN></P> <P><SPAN>We'd like the output to only show unmatched data.</SPAN></P> <P>&nbsp;</P> Tue, 07 Mar 2023 15:25:51 GMT https://community.splunk.com/t5/Getting-Data-In/Importing-HCL-BigFix-data-from-Insights-how-to-verify/m-p/633489#M108449 richtate 2023-03-07T15:25:51Z