https://community.splunk.com/t5/Splunk-Search/how-to-write-dbquery-in-search/m-p/157219#M185797 <P>Hi guys,<BR /> Please help me to write a dbquery in search bar.I have the following dbquery <BR /> | dbquery "databasename" "select la,ba from abc" .<BR /> I want to type this query in search bar as <BR /> source=databasename sourcetype=tablename | fields la,ba</P> <P>I tried but it says invalid source or sourcetype. Please help me to write dbquery in search bar so that Splunk can read it in it's own syntax .....</P> Wed, 19 Feb 2014 15:01:00 GMT vikas_gopal 2014-02-19T15:01:00Z https://community.splunk.com/t5/Splunk-Search/how-to-write-dbquery-in-search/m-p/157219#M185797 <P>Hi guys,<BR /> Please help me to write a dbquery in search bar.I have the following dbquery <BR /> | dbquery "databasename" "select la,ba from abc" .<BR /> I want to type this query in search bar as <BR /> source=databasename sourcetype=tablename | fields la,ba</P> <P>I tried but it says invalid source or sourcetype. Please help me to write dbquery in search bar so that Splunk can read it in it's own syntax .....</P> Wed, 19 Feb 2014 15:01:00 GMT https://community.splunk.com/t5/Splunk-Search/how-to-write-dbquery-in-search/m-p/157219#M185797 vikas_gopal 2014-02-19T15:01:00Z https://community.splunk.com/t5/Splunk-Search/how-to-write-dbquery-in-search/m-p/157220#M185798 <P>That's not going to work, Splunk cannot translate SPL into SQL.</P> <P>What's wrong with using <CODE>| dbquery databasename "SQL query"</CODE>?</P> Wed, 19 Feb 2014 16:30:48 GMT https://community.splunk.com/t5/Splunk-Search/how-to-write-dbquery-in-search/m-p/157220#M185798 martin_mueller 2014-02-19T16:30:48Z https://community.splunk.com/t5/Splunk-Search/how-to-write-dbquery-in-search/m-p/157221#M185799 <P>Thanks Martin..in the first line you cleared my doubt and nothing is wrong with |dbquery it works absolutely fine but I am trying to understand the concept how indexing will work with DBconnect.Please correct me if I am wrong , as per my understanding Splunk will act as frontend app if we connect to database using DBConnect app Splunk won't do indexing of the data.If it does then how (I mean at what stage it indexes the data is it at the time of running the query or at the time of connecting database using DBconnect)</P> Wed, 19 Feb 2014 17:42:02 GMT https://community.splunk.com/t5/Splunk-Search/how-to-write-dbquery-in-search/m-p/157221#M185799 vikas_gopal 2014-02-19T17:42:02Z https://community.splunk.com/t5/Splunk-Search/how-to-write-dbquery-in-search/m-p/157222#M185800 <P>FYI I build connection to oracle database with ODBC and in DBconeect I used "database connection in Splunk manager" option .</P> Wed, 19 Feb 2014 18:09:32 GMT https://community.splunk.com/t5/Splunk-Search/how-to-write-dbquery-in-search/m-p/157222#M185800 vikas_gopal 2014-02-19T18:09:32Z https://community.splunk.com/t5/Splunk-Search/how-to-write-dbquery-in-search/m-p/157223#M185801 <P>Running a piece of SQL through <CODE>dbquery</CODE> and indexing events from a database are two unrelated concepts, <CODE>dbquery</CODE> runs its SQL at search time, no indexing involved.</P> <P>You can configure DBConnect to run SQL queries on a schedule and index their results, see <A href="http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Configuredatabasemonitoring">http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Configuredatabasemonitoring</A> for more info.</P> Wed, 19 Feb 2014 18:10:38 GMT https://community.splunk.com/t5/Splunk-Search/how-to-write-dbquery-in-search/m-p/157223#M185801 martin_mueller 2014-02-19T18:10:38Z