https://community.splunk.com/t5/Splunk-Search/DB-Connect-database-input-How-to-output-some-text-if-query-gives/m-p/139602#M184809 <P>Hi, can you file an enhancement request with support?</P> Sun, 14 Jun 2015 02:07:58 GMT jcoates_splunk 2015-06-14T02:07:58Z https://community.splunk.com/t5/Splunk-Search/DB-Connect-database-input-How-to-output-some-text-if-query-gives/m-p/139601#M184808 <P>Some important queries that run every 5 or 10 minutes that are configured as DB Connect database inputs, give rarely any results on queries. Only on exceptions. As we have alerts configured that check when the last event was indexed, something like<BR /> <CODE>metadata type=sourcetypes | search sourcetype="something:else" | where lastTime&amp;lt;now()-3600</CODE> (think of it as a universal forwarder down check)</P> <P>But we either have to filter out this specific host or source when no event comes in, or change the SQL query so that IF no results THEN echo something like OK or Nothing found. That way there's also some kind of healthcheck as a new event should be indexed every run.</P> <P>Of course you can -as we did for now- configure an identical database input with 'select 'OK' from DUAL' (some kind of PING if you like) - but it would be easier to combine those two inputs into one query. Haven't googled any solution, and our DBA isn't aware of any query that meets the requirements.</P> Tue, 02 Jun 2015 11:03:49 GMT https://community.splunk.com/t5/Splunk-Search/DB-Connect-database-input-How-to-output-some-text-if-query-gives/m-p/139601#M184808 tweaktubbie 2015-06-02T11:03:49Z https://community.splunk.com/t5/Splunk-Search/DB-Connect-database-input-How-to-output-some-text-if-query-gives/m-p/139602#M184809 <P>Hi, can you file an enhancement request with support?</P> Sun, 14 Jun 2015 02:07:58 GMT https://community.splunk.com/t5/Splunk-Search/DB-Connect-database-input-How-to-output-some-text-if-query-gives/m-p/139602#M184809 jcoates_splunk 2015-06-14T02:07:58Z