topic Re: Splunk DB Connect 1: Can I run dbquery with a variable? in Reporting

Splunk DB Connect 1: Can I run dbquery with a variable?

stepheneardley — Tue, 01 Mar 2016 21:13:35 GMT

I need to schedule a report which runs dbquery, but I need that report to run with a variable in the query e.g.

| eval myVar=stuff
| dbquery source "select * from table where timestamp >= '".myVar."'"

Or something like that, but of course this doesn't work since dbquery must be the first command of a search.

Has anyone come across this before or found a way around it?

somesoni2 — Tue, 01 Mar 2016 22:38:13 GMT

You can try like this (using map command)

| gentimes start=-1 | eval myVar=stuff | map search="| dbquery source \"select * from tble where timestamp >= $myVar$ \" "

stepheneardley — Wed, 02 Mar 2016 11:46:27 GMT

Worked a treat. Thanks. I can't figure out what gentimes is used for though.