topic Re: DBConnect dobbel quotes in key value pair in Splunk Search

DBConnect dobbel quotes in key value pair

lyngstad — Thu, 07 Nov 2024 11:25:22 GMT

Hello

I have a DBConnect query that gets data from a database and then send it to a Splunk index. Below are the query and also how it looks in Splunk. The data is being indexed as key=value pair with dobbel quotes around "value". I have plenty of other data that is not using DBConnect and they dont have dobbel quotes around value.

Maybe the quotes is there because im using DBConnect?

Is it possible to index data from DBConnect without adding the quotes?

When i try to searc the data in Splunk i just dont get any data. I think it may have to do with the dobbel quotes? I'm not sure.

Here are the search string. The air_temp is defined in the Climate datamodel. The TA(air temperature) in the data is defined in props.conf with the right sourcetype TU_CLM_Time.

| tstats avg(Climate.air_temp) as air_temp from datamodel="Climate" where sourcetype="TU_CLM_Time" host=TU_CLM_1 by host _time span=60m ```Fetching relevant fields from CLM sourcetype in CLM datamodel.```

Re: DBConnect dobbel quotes in key value pair

victor_menezes — Thu, 07 Nov 2024 14:41:13 GMT

Hi @lyngstad ,

Based in your search results screenshot, you get the values from the by clause but lack the calculation of air temp, so I guess the trick is to format the datamodel to be measured (so yes, it may be related to some double quotes around the values).

Can you try this then? Trying to get it via "values" so we can later convert to number and remove the quotes, which will allow average metric.

| tstats values(Climate.air_temp) as air_temp_raw from datamodel="Climate" where sourcetype="TU_CLM_Time" host=TU_CLM_1 by host _time span=60m | eval air_temp_numeric = tonumber(trim(air_temp_raw, "\"")) | stats avg(air_temp_numeric) as air_temp by host _time

Re: DBConnect dobbel quotes in key value pair

lyngstad — Thu, 07 Nov 2024 15:02:13 GMT

Thanks for answering.

I tried the search you provided with no luck.

Re: DBConnect dobbel quotes in key value pair

victor_menezes — Thu, 07 Nov 2024 16:38:41 GMT

Okay, in this case, please share the search that renders the datamodel. Perhaps you can do the replace there to make sure there are no double quotes returned on Climate.air_temp field.

Re: DBConnect dobbel quotes in key value pair

lyngstad — Fri, 08 Nov 2024 07:38:55 GMT

Okey, so i dont now exactly where the search is. I have the datamodel.