https://community.splunk.com/t5/Splunk-Search/DB-Connect-1-Is-it-possible-to-get-a-new-field-using-dbquery/m-p/157195#M185795 <P>The right way to do this is a dblookup.</P> Mon, 29 Jun 2015 02:52:01 GMT jcoates_splunk 2015-06-29T02:52:01Z https://community.splunk.com/t5/Splunk-Search/DB-Connect-1-Is-it-possible-to-get-a-new-field-using-dbquery/m-p/157194#M185794 <P>Hi </P> <P>I want to know if it's possible to get a new field from dbquery that does not exist in an index:</P> <PRE><CODE>index=A [|inputlookup file.csv | table field_ip] | join type=outer fieldA [dbquery ..."select......" |fields + fieldA |rename fieldA as fieldB] |table fieldB </CODE></PRE> <P>i tried this, but was not successful. fieldB doesn't exist in index=A, but i need it. How can i do it? </P> <P>thx</P> Mon, 15 Jun 2015 15:12:48 GMT https://community.splunk.com/t5/Splunk-Search/DB-Connect-1-Is-it-possible-to-get-a-new-field-using-dbquery/m-p/157194#M185794 sfatnass 2015-06-15T15:12:48Z https://community.splunk.com/t5/Splunk-Search/DB-Connect-1-Is-it-possible-to-get-a-new-field-using-dbquery/m-p/157195#M185795 <P>The right way to do this is a dblookup.</P> Mon, 29 Jun 2015 02:52:01 GMT https://community.splunk.com/t5/Splunk-Search/DB-Connect-1-Is-it-possible-to-get-a-new-field-using-dbquery/m-p/157195#M185795 jcoates_splunk 2015-06-29T02:52:01Z https://community.splunk.com/t5/Splunk-Search/DB-Connect-1-Is-it-possible-to-get-a-new-field-using-dbquery/m-p/157196#M185796 <P>but the dblookup can return just the first matching line in my database</P> Tue, 30 Jun 2015 07:27:51 GMT https://community.splunk.com/t5/Splunk-Search/DB-Connect-1-Is-it-possible-to-get-a-new-field-using-dbquery/m-p/157196#M185796 sfatnass 2015-06-30T07:27:51Z