topic Re: How to extract fields from database column using sql query on splunk db connect application. in Getting Data In https://community.splunk.com/t5/Getting-Data-In/How-to-extract-fields-from-database-column-using-sql-query-on/m-p/536248#M89900 <P>extract command in Splunk may help..</P><P>Sample query:</P><P>|makeresults | eval _raw=" Status<BR />login failed...\nhost=xyz |\nip=0.0.0.0<BR />login successful<BR />host=xyz |\n ip=0.0.0.0 |" | multikv forceheader=1 | eval Status=split(Status,"\n") | eval temp=_raw,_raw=Status | extract | rename temp as _raw</P> Mon, 18 Jan 2021 18:07:39 GMT saravanan90 2021-01-18T18:07:39Z How to extract fields from database column using sql query on splunk db connect application. https://community.splunk.com/t5/Getting-Data-In/How-to-extract-fields-from-database-column-using-sql-query-on/m-p/536246#M89899 <P>Hi All,</P><P>I kindly request your help to get fields extracted from database column. I'm working on splunk db-connect app. Can anyone please provide me sample sql query to extract subfields from status field?</P><P>For e.g. I would need something like msg=login failed, host and ip fields to be extracted from below unique database records.&nbsp;</P><P>Sample Database output with unique records from splunk db-connect app:</P><P>&nbsp;Date&nbsp; &nbsp;User&nbsp; Input&nbsp; &nbsp; &nbsp; &nbsp; Status</P><P>&nbsp; xxx&nbsp; &nbsp; &nbsp;abc&nbsp; &nbsp; &nbsp; 123&nbsp; &nbsp; &nbsp; &nbsp; login failed...</P><P>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; host=xyz |</P><P>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ip=0.0.0.0 |</P><P>&nbsp;yyy&nbsp; &nbsp; &nbsp; xyz&nbsp; &nbsp; &nbsp; 456&nbsp; &nbsp; &nbsp; &nbsp;login successful</P><P>&nbsp;zzz&nbsp; &nbsp; &nbsp;pqr&nbsp; &nbsp; &nbsp; &nbsp;789&nbsp; &nbsp; &nbsp; &nbsp;host=xyz |</P><P>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;ip=0.0.0.0 |</P><P>&nbsp;</P><P>Appreciate your help!!</P><P>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;</P> Mon, 18 Jan 2021 17:44:30 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-extract-fields-from-database-column-using-sql-query-on/m-p/536246#M89899 firefox95 2021-01-18T17:44:30Z Re: How to extract fields from database column using sql query on splunk db connect application. https://community.splunk.com/t5/Getting-Data-In/How-to-extract-fields-from-database-column-using-sql-query-on/m-p/536248#M89900 <P>extract command in Splunk may help..</P><P>Sample query:</P><P>|makeresults | eval _raw=" Status<BR />login failed...\nhost=xyz |\nip=0.0.0.0<BR />login successful<BR />host=xyz |\n ip=0.0.0.0 |" | multikv forceheader=1 | eval Status=split(Status,"\n") | eval temp=_raw,_raw=Status | extract | rename temp as _raw</P> Mon, 18 Jan 2021 18:07:39 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-extract-fields-from-database-column-using-sql-query-on/m-p/536248#M89900 saravanan90 2021-01-18T18:07:39Z Re: How to extract fields from database column using sql query on splunk db connect application. https://community.splunk.com/t5/Getting-Data-In/How-to-extract-fields-from-database-column-using-sql-query-on/m-p/536252#M89901 <P>You should contact a DBA for the database in question for help writing a SQL query for that database.</P> Mon, 18 Jan 2021 19:03:03 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-extract-fields-from-database-column-using-sql-query-on/m-p/536252#M89901 richgalloway 2021-01-18T19:03:03Z