topic Re: insert the earliest and latest in the DBquery in Splunk Search

insert the earliest and latest in the DBquery

radomo — Thu, 03 Oct 2013 15:09:48 GMT

Hello

I'm breaking my brain for make one thing. I recovery the data from External database, in this point no problem, the problem success when I need insert the earliest and latest in the query.

is it possible make this? or in the other hand am I trying something impossible?

I'd tried to resolve with insert the variable into the splunkQuery but nothing.

This is the query

<input type="time">
        <default>Last 7 days</default> 
      </input>
      <searchString>| dbquery mydb limit=1000 "select DATE_FORMAT(en.fechaExpedicion,'%d-%m-%Y') as fecha, sum(something) as adds WHERE DATE(en.date) BETWEEN DATE($earliestTime$)  AND DATE($latestTime$) " | table fecha, * | addtotals fieldname="TOTAL DIA" *
</searchString>

Re: insert the earliest and latest in the DBquery

alacercogitatus — Thu, 03 Oct 2013 16:46:19 GMT

There isn't a previous search to pull earliest/latest times. You could put in fields that take earliest and latest.

<input type="text" token="earliestDBTime" /><input type="text"token="latestDBTime" /> <searchString> |dbquery mydb limit=10000 "select DATE_FORMAT(......) | table fecha * |addtotals fieldname="TOTAL DIA" * </searchString>

Re: insert the earliest and latest in the DBquery

radomo — Fri, 04 Oct 2013 06:44:51 GMT

Thanks for your fast answer, you have gave me a different point of view and I like it.
It's a great solution.

Thanks