https://community.splunk.com/t5/Splunk-Search/Splunk-DB-Connect-1-Is-it-possible-to-use-an-eval-before-dbquery/m-p/152537#M185570 <P>ok try like :<BR /> |dbquery mydatabase "select field2 from my_table"|fields + field2|appendcols [ search index="indexA" OR index="indexB" |eval newfield=field1] |stats values(newfield) as newfield values(field2) as field2 by field1</P> Wed, 10 Jun 2015 11:36:39 GMT fdi01 2015-06-10T11:36:39Z https://community.splunk.com/t5/Splunk-Search/Splunk-DB-Connect-1-Is-it-possible-to-use-an-eval-before-dbquery/m-p/152534#M185567 <P>Hi everybody,</P> <P>I want to know if it's possible to use an eval before [dbquery "select blablabla"]</P> <P>For example:</P> <PRE><CODE>index="indexA" OR index="indexB" |eval newfield=field1 |stats values(newfield) as newfield values(field2) as field2 by field1 [dbquery mydatabase "select field2 from my_table"|fields + field2] </CODE></PRE> <P>well i'm trying to get something like that, but splunk said eval is not used properly</P> <P>I need to record all values of <CODE>field1</CODE> from the index.<BR /> The lookup cannot be used for the requested sql. <BR /> if anybody have any idea thx </P> Wed, 10 Jun 2015 08:55:24 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-DB-Connect-1-Is-it-possible-to-use-an-eval-before-dbquery/m-p/152534#M185567 sfatnass 2015-06-10T08:55:24Z https://community.splunk.com/t5/Splunk-Search/Splunk-DB-Connect-1-Is-it-possible-to-use-an-eval-before-dbquery/m-p/152535#M185568 <P>try lik:</P> <PRE><CODE>|dbquery mydatabase "select field2 from my_table"|fields + field2|appendcols [ search index="indexA" OR index="indexB" |eval newfield=field1 |stats values(newfield) as newfield values(field2) as field2 by field1] </CODE></PRE> Wed, 10 Jun 2015 09:39:32 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-DB-Connect-1-Is-it-possible-to-use-an-eval-before-dbquery/m-p/152535#M185568 fdi01 2015-06-10T09:39:32Z https://community.splunk.com/t5/Splunk-Search/Splunk-DB-Connect-1-Is-it-possible-to-use-an-eval-before-dbquery/m-p/152536#M185569 <P>the dbquery not match with my index<BR /> for informaitons i use many dbquery in my request splunk</P> Wed, 10 Jun 2015 11:11:07 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-DB-Connect-1-Is-it-possible-to-use-an-eval-before-dbquery/m-p/152536#M185569 sfatnass 2015-06-10T11:11:07Z https://community.splunk.com/t5/Splunk-Search/Splunk-DB-Connect-1-Is-it-possible-to-use-an-eval-before-dbquery/m-p/152537#M185570 <P>ok try like :<BR /> |dbquery mydatabase "select field2 from my_table"|fields + field2|appendcols [ search index="indexA" OR index="indexB" |eval newfield=field1] |stats values(newfield) as newfield values(field2) as field2 by field1</P> Wed, 10 Jun 2015 11:36:39 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-DB-Connect-1-Is-it-possible-to-use-an-eval-before-dbquery/m-p/152537#M185570 fdi01 2015-06-10T11:36:39Z https://community.splunk.com/t5/Splunk-Search/Splunk-DB-Connect-1-Is-it-possible-to-use-an-eval-before-dbquery/m-p/152538#M185571 <P>finally the kvstore resolve my problem thx</P> Fri, 12 Jun 2015 11:10:07 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-DB-Connect-1-Is-it-possible-to-use-an-eval-before-dbquery/m-p/152538#M185571 sfatnass 2015-06-12T11:10:07Z