topic How to create SQL query from log? in Splunk Search

How to create SQL query from log?

jeesphilipz — Wed, 18 May 2022 16:43:23 GMT

I have two files Filed1 and Filed2, Fileld1 is procedure call and Files 2 is the arguments

i want to make a proper procedure call out of it by replacing "?" with actual vales from the arguments

Eg:
Filed1 exec procedureABC arg1 = ?, arg2 = ?, arg3 = ?

Filed2 arg1=EXEC, arg2=472.59, arg3=ABCI want to make a string like this "exec proc1 arg1 = EXEC, arg2 = 472.59, arg3 = ABC"
How can i do this ?

Re: Create SQL query from log

richgalloway — Wed, 18 May 2022 14:20:35 GMT

Assuming the fields are always in the format shown, you can extract the procedure from Field1 and append the contents of Field2 as the arguments.

| rex field=Field1 "(?<call>.*?) arg1" | eval exec = call . " " . Field2

Re: Create SQL query from log

jeesphilipz — Wed, 18 May 2022 14:43:33 GMT

thanks for the reply

That didn't help me ,

procedure call would be more complex and some times the argument list can have more element in it
eg : exec procedureABC @arg1 = ?, @arg2 = ?, @arg3 = ? in real scenario the procedure call parameter begin with '@'

and the argument list wont have any '@' in it. also argument list can have more than 10 elements so we need a lookup there