topic sql query to splunk query in Splunk Search

sql query to splunk query

deeptha1992 — Wed, 30 Sep 2020 01:48:57 GMT

How I can Change this sql query to splunk query, I tried in different way but It is not giving proper result please help me

Select sys.name as 'CName', count(ucs.RID) [Update], sys.Workgr as 'Domain'
From Update_CS ucs
JOIN System sys on sys. RID = ucs. RID
JOIN UpdateIn ui on ucs.CID = ui.CID
Where ucs. RID IN(Select RID from FullCollection where Coll_ID = '1010') AND
UCS.CID IN(select TCID from SMS_CIR
where FCID = '100200') AND UCS.status in ('0','2')
GROUP BY sys.name, sys. Workgr
ORDER BY 'CName' ASC

Thanks in advance

Re: sql query to splunk query

Azeemering — Wed, 21 Aug 2019 11:13:20 GMT

Try this:

| dbxquery query="Select sys.name as 'CName', count(ucs.RID) [Update], sys.Workgr as 'Domain'
 From Update_CS ucs
 JOIN System sys on sys. RID = ucs. RID
 JOIN UpdateIn ui on ucs.CID = ui.CID
 Where ucs. RID IN(Select RID from FullCollection where Coll_ID = '1010') AND
 UCS.CID IN(select TCID from SMS_CIR
 where FCID = '100200') AND UCS.status in ('0','2')
 GROUP BY sys.name, sys. Workgr
 ORDER BY 'CName' ASC" connection="<not_selected>"

Re: sql query to splunk query

deeptha1992 — Wed, 21 Aug 2019 11:42:15 GMT

Thanks.. But i need to convert this to SPL query. I have onboarded the table through splunk db connect. I need to create dashboard as like this query provided. want to know how to write a search query from this given sql query.

Re: sql query to splunk query

kamlesh_vaghela — Wed, 21 Aug 2019 12:44:41 GMT

@deeptha1992

Please check below link and let us know if you require any further assistance in SPL design.

https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/SQLtoSplunk

Re: sql query to splunk query

harish_l — Wed, 21 Aug 2019 14:36:18 GMT

Please try with below syntax to get the SQL query working in splunk:

| dbxquery connection= [fetchsize=] [maxrows=] [timeout=] [shortnames=] query= OR procedure= [params=]

For more information: Please see the splunk documentation.

https://docs.splunk.com/Documentation/DBX/3.1.4/DeployDBX/Commands