https://community.splunk.com/t5/Splunk-Search/DBQUERY-correlation-How-to-join-results-from-DB/m-p/158658#M185875 <P>Hi,<BR /> I get the user_id info from web log and would like to enrich data from the connected DB in Splunk. I tried the search query below but it didn't work. Can anyone provide the right syntax?</P> <PRE><CODE>index=web_access_log | table user_id | RENAME user_id AS web_user_id [ search dbquery USER_SQL_DB "select web_user_id, user_type, user_email, user_phone from user_profile_view_all where web_user_id=$web_user_id$ "] </CODE></PRE> Fri, 25 Jul 2014 19:16:18 GMT shangshin 2014-07-25T19:16:18Z https://community.splunk.com/t5/Splunk-Search/DBQUERY-correlation-How-to-join-results-from-DB/m-p/158658#M185875 <P>Hi,<BR /> I get the user_id info from web log and would like to enrich data from the connected DB in Splunk. I tried the search query below but it didn't work. Can anyone provide the right syntax?</P> <PRE><CODE>index=web_access_log | table user_id | RENAME user_id AS web_user_id [ search dbquery USER_SQL_DB "select web_user_id, user_type, user_email, user_phone from user_profile_view_all where web_user_id=$web_user_id$ "] </CODE></PRE> Fri, 25 Jul 2014 19:16:18 GMT https://community.splunk.com/t5/Splunk-Search/DBQUERY-correlation-How-to-join-results-from-DB/m-p/158658#M185875 shangshin 2014-07-25T19:16:18Z https://community.splunk.com/t5/Splunk-Search/DBQUERY-correlation-How-to-join-results-from-DB/m-p/158659#M185876 <P>Try this (using map command)</P> <PRE><CODE>index=web_access_log | table user_id | map maxsearches=100 search="| dbquery USER_SQL_DB \"select web_user_id, user_type, user_email, user_phone from user_profile_view_all where web_user_id=$user_id$ \"" </CODE></PRE> Fri, 25 Jul 2014 20:52:39 GMT https://community.splunk.com/t5/Splunk-Search/DBQUERY-correlation-How-to-join-results-from-DB/m-p/158659#M185876 somesoni2 2014-07-25T20:52:39Z https://community.splunk.com/t5/Splunk-Search/DBQUERY-correlation-How-to-join-results-from-DB/m-p/158660#M185877 <P>Thanks for the response. I gave it a try and I can see s few events returned from the first query but no result is returned in the end. <BR /> I suspect the syntax needs to be polished up.....</P> Fri, 25 Jul 2014 21:10:48 GMT https://community.splunk.com/t5/Splunk-Search/DBQUERY-correlation-How-to-join-results-from-DB/m-p/158660#M185877 shangshin 2014-07-25T21:10:48Z https://community.splunk.com/t5/Splunk-Search/DBQUERY-correlation-How-to-join-results-from-DB/m-p/158661#M185878 <P>Define a database lookup: <A href="http://docs.splunk.com/Documentation/DBX/1.1.4/DeployDBX/Setupadatabaselookuptable">http://docs.splunk.com/Documentation/DBX/1.1.4/DeployDBX/Setupadatabaselookuptable</A></P> Fri, 25 Jul 2014 21:35:21 GMT https://community.splunk.com/t5/Splunk-Search/DBQUERY-correlation-How-to-join-results-from-DB/m-p/158661#M185878 martin_mueller 2014-07-25T21:35:21Z https://community.splunk.com/t5/Splunk-Search/DBQUERY-correlation-How-to-join-results-from-DB/m-p/158662#M185879 <P>It's working after adding the single quote for the variable. Is it possible to get more than one field value from the first query in the final result e.g. url?</P> <P>e.g.</P> <P>index=web_access_log | table user_id, url | map maxsearches=100 search="| dbquery USER_SQL_DB \"select web_user_id, user_type, user_email, user_phone from user_profile_view_all where web_user_id='$user_id$' \""</P> Mon, 28 Sep 2020 17:11:25 GMT https://community.splunk.com/t5/Splunk-Search/DBQUERY-correlation-How-to-join-results-from-DB/m-p/158662#M185879 shangshin 2020-09-28T17:11:25Z https://community.splunk.com/t5/Splunk-Search/DBQUERY-correlation-How-to-join-results-from-DB/m-p/158663#M185880 <P>You can use any number of field names you like.</P> <P>Did you look at database lookups? It seems to me as if you're reimplementing those.</P> Mon, 28 Jul 2014 17:22:35 GMT https://community.splunk.com/t5/Splunk-Search/DBQUERY-correlation-How-to-join-results-from-DB/m-p/158663#M185880 martin_mueller 2014-07-28T17:22:35Z