topic Re: Splunk DB Connect 1: Where do I put the token name in a dbquery search string for a chart drilldown? in Splunk Search https://community.splunk.com/t5/Splunk-Search/Splunk-DB-Connect-1-Where-do-I-put-the-token-name-in-a-dbquery/m-p/171213#M186412 <P>Yes. Thank you verymuch. I have already got it. I have tried like that same process</P> Wed, 24 Jun 2015 12:11:05 GMT kavyaa 2015-06-24T12:11:05Z Splunk DB Connect 1: Where do I put the token name in a dbquery search string for a chart drilldown? https://community.splunk.com/t5/Splunk-Search/Splunk-DB-Connect-1-Where-do-I-put-the-token-name-in-a-dbquery/m-p/171210#M186409 <P>Hi,</P> <P>I'm using Splunk 6.2.3 and DB Connect 1. I have connected to an Oracle database. I have applied an input drilldown on a chart, but it is showing <CODE>"error in dbquery command". this command must be in first search"</CODE>. Please help me and share any document for this.</P> <P>Thanks in advance,<BR /> A.kavya.<span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/417i5CC7E172C8241334/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Wed, 24 Jun 2015 07:03:06 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-DB-Connect-1-Where-do-I-put-the-token-name-in-a-dbquery/m-p/171210#M186409 kavyaa 2015-06-24T07:03:06Z Re: Splunk DB Connect 1: Where do I put the token name in a dbquery search string for a chart drilldown? https://community.splunk.com/t5/Splunk-Search/Splunk-DB-Connect-1-Where-do-I-put-the-token-name-in-a-dbquery/m-p/171211#M186410 <P>dbquery command must exist as the first word in the query. you can use token fields inside the query or later part.</P> Wed, 24 Jun 2015 07:07:01 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-DB-Connect-1-Where-do-I-put-the-token-name-in-a-dbquery/m-p/171211#M186410 srinathd 2015-06-24T07:07:01Z Re: Splunk DB Connect 1: Where do I put the token name in a dbquery search string for a chart drilldown? https://community.splunk.com/t5/Splunk-Search/Splunk-DB-Connect-1-Where-do-I-put-the-token-name-in-a-dbquery/m-p/171212#M186411 <P>try like:</P> <PRE><CODE> | dbquery Oracle limit=1000 "SELECT DISTINCTn EFZ_VIEW_DWT_CBS_GL_BAL.COMPANY_CODE as Subsidiary,n EFZ_VIEW_DWT_CBS_ ...."|eval your_field_name="$field1$"|where your_filter_field=your_field_name|.... </CODE></PRE> Wed, 24 Jun 2015 11:02:55 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-DB-Connect-1-Where-do-I-put-the-token-name-in-a-dbquery/m-p/171212#M186411 fdi01 2015-06-24T11:02:55Z Re: Splunk DB Connect 1: Where do I put the token name in a dbquery search string for a chart drilldown? https://community.splunk.com/t5/Splunk-Search/Splunk-DB-Connect-1-Where-do-I-put-the-token-name-in-a-dbquery/m-p/171213#M186412 <P>Yes. Thank you verymuch. I have already got it. I have tried like that same process</P> Wed, 24 Jun 2015 12:11:05 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-DB-Connect-1-Where-do-I-put-the-token-name-in-a-dbquery/m-p/171213#M186412 kavyaa 2015-06-24T12:11:05Z Re: Splunk DB Connect 1: Where do I put the token name in a dbquery search string for a chart drilldown? https://community.splunk.com/t5/Splunk-Search/Splunk-DB-Connect-1-Where-do-I-put-the-token-name-in-a-dbquery/m-p/171214#M186413 <P>i happy for you.</P> Wed, 24 Jun 2015 12:50:56 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-DB-Connect-1-Where-do-I-put-the-token-name-in-a-dbquery/m-p/171214#M186413 fdi01 2015-06-24T12:50:56Z