topic Re: Multiple inputs in dashboard in Splunk Search

Multiple inputs in dashboard

Raging_Rags — Sat, 20 Jun 2020 02:01:41 GMT

I have multiple inputs(3 INPUTS) in a dashboard, I run a sql in the panels. I want to execute a query if the other two values are null. Can you help me with the query.

|dbxquery connection="*" query="select * from usr where mID like 'id=$dn$%'". Other values $in_ID, ex_ID. I want to execute this query if values of $in_ID, ex_ID is null.

Re: Multiple inputs in dashboard

gcusello — Sat, 20 Jun 2020 06:20:50 GMT

Hi @Raging_Rags ,

probably this isn't the answer you're waiting for: your approach isn't efficient because dbxquery in a panel is a very slow command.

dbxquery is a command (as dbxlookup) to extract data from a db and put them in an index (or in a lookup) with scheduled searches as less frequent as possible, then you can use the extracted data for your Splunk searches that are very efficient.

Ciao.

Giuseppe

Re: Multiple inputs in dashboard

Raging_Rags — Sat, 20 Jun 2020 08:01:34 GMT

Yeah, That's a good idea, but I'm working on a dynamic database, which at least 100K data get indexed in the table. So, I'm not indexing it in Splunk just connecting the DB to Splunk.

Re: Multiple inputs in dashboard

gcusello — Sat, 20 Jun 2020 09:47:16 GMT

Hi @Raging_Rags ,

maybe I shouldn't say it but I would say that in your case maybe Splunk is not the optimal solution: If you have to work with a database, use another tool.

Access to DB tables is useful to trace a process or to enrich a search, it isn't another interface to DB!

Splunk and a DB has a completely different approach to data searching.

For this reason I suggested to periodically extract data from a DB putting them in an index or in a lookup (eventually in a KV Store that's like a DB).

Think if you can follow this approach: a daily update of all the table and periodically (e.g. every hour) extraction of the updates, in this way you'll have a near real time situation but much much more usable.

Ciao.

Giuseppe