topic DBConnect - Best way to join three tables in Splunk Search

DBConnect - Best way to join three tables

UMoritz — Tue, 21 Jan 2014 14:28:18 GMT

I've three tables with the following structure in the same Microsoft SQL database:

ApplicationEvent - Columns: id,application_id,message

Application - Columns: id,name, applicationtype_id

ApplicationType - Columns: id, name

I want to get the following row in SPLUNK:
ApplicationEvent.message, Application.name, ApplicationType.name

What's the best way to achieve this?

I've tried automatic lookups, lookup command and join without success.

Thanks in advance

martin_mueller — Tue, 21 Jan 2014 14:54:11 GMT

Have you considered joining them in SQL before indexing / loading into Splunk?

linu1988 — Tue, 21 Jan 2014 17:37:13 GMT

Yes best think to do, it's waste of resource to do that in splunk..

jpass — Tue, 21 Jan 2014 18:26:32 GMT

Why not create a 'view' on the database server that joins these tables. Then your dbconnect query is a simple select * from view_name

UMoritz — Wed, 22 Jan 2014 10:30:20 GMT

Hi all

Thanks for your answers. I'll check this.

UMoritz — Wed, 22 Jan 2014 10:30:47 GMT

Hi jpass

thanks to you, too.