Unable to run query '| dbxquery query ?

mateusztumi84 — Tue, 21 Feb 2023 19:52:05 GMT

Hi,

I'm quite fresh in splunk and need your help. Trying to combine spl with sql.

tag 25 is event id same as sql ele.batch_event_id

I suspect ele.batch_event_id = $25$ is wrong.

Any idea please 🙂

Error is :

Unable to run query '| dbxquery query= "SELECT MIN (ele.process_time) as MIN_PROCESS_time ,MAX (ele.process_time) as MAX_PROCESS_time FROM estar.estar_loopback_events ele, estar.engine_configuration ec WHERE ele.engine_instance = ec.engine_instance AND ele.batch_event_id = $25$ AND process_time BETWEEN TO_DATE('20230215:00:00','YYYYMMDD hh24:mi:ss') and TO_DATE('20230216 12:59:59','YYYYMMDD hh24:mi:ss') " connection='stardb' '.

Search:

index=star_linux sourcetype=engine_processed_events 2961= BBHCC-S2PBATCHPOS-BO OR BBHCC-S2PBATCHPOS-B2 OR BBHCC-S2PBATCHPOS-PO OR BBHCC-SOD-IF-Weekday-1 AND 55:GEN_STAR_PACE
|table 4896,25,55,2961

| map search="| dbxquery query= \"SELECT MIN (ele.process_time) as MIN_PROCESS_time ,MAX (ele.process_time) as MAX_PROCESS_time
FROM
estar.estar_loopback_events ele,
estar.engine_configuration ec
WHERE ele.engine_instance = ec.engine_instance
AND ele.batch_event_id = $25$
AND process_time BETWEEN TO_DATE('20230215:00:00','YYYYMMDD hh24:mi:ss')
and TO_DATE('20230216 12:59:59','YYYYMMDD hh24:mi:ss') \" connection='stardb' "
|table 4896, 25,MIN_PROCESS_time, MAX_PROCESS_time

Re: Unable to run query '| dbxquery query

richgalloway — Thu, 16 Feb 2023 13:25:07 GMT

The construct $<something>$ is valid only with the map command or in a dashboard. In every case, however, <something> must be a token name or field name rather than a number.

If ele.batch_event_id is a number then use ele.batch_event_id=25; otherwise, use ele.batch_event_id = "25"

Re: Unable to run query '| dbxquery query

mateusztumi84 — Mon, 20 Feb 2023 09:15:38 GMT

ele.engine_instance is alfanumeric field like 6JPK6699UV05FV51 eg.

Re: Unable to run query '| dbxquery query

mateusztumi84 — Mon, 20 Feb 2023 09:16:59 GMT

ele.engine_instance is alfanumeric field like 6JPK6699UV05FV51 eg.

topic Unable to run query '| dbxquery query ? in Splunk Search

Unable to run query '| dbxquery query ?

Re: Unable to run query '| dbxquery query

Re: Unable to run query '| dbxquery query

Re: Unable to run query '| dbxquery query