topic Re: How do you use the Database Connect Alert Action? in Splunk Search

How do you use the Database Connect Alert Action?

Andre_ — Mon, 07 Jul 2025 21:54:45 GMT

Hello,

I have Database Connect setup and it's working all fine. But I can't wrap my head around how the Alert Action works.

The Alert action "Output results to databases" has no parameters - what am I missing?

I have a DB table "test_table" with columns col1, col2 and want to setup

| makeresults | eval col1 = "test", col2 = "result"

as an alert that pushes the results into the "test_table". I would expect the Alert action to at least need to know what DB Output to use?

Any help appreciated,

Kind Regards
Andre

Re: How do you use the Database Connect Alert Action?

PrewinThomas — Tue, 08 Jul 2025 06:38:16 GMT

@Andre_

Did you create database outputs first? The alert action does not prompt for parameters because it uses the mapping and connection you set up in the DB Connect app’s Outputs.

#https://help.splunk.com/en/splunk-cloud-platform/connect-relational-databases/deploy-and-use-splunk-db-connect/3.18/configure-and-manage-splunk-db-connect/create-and-manage-database-outputs#id_8af48766_8b49_4f27_8138_a2cdf208e86c__Create_a_database_output

If you want to test it manually, use | dbxoutput output="output_to_test_table" in your SPL

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

Re: How do you use the Database Connect Alert Action?

Andre_ — Tue, 08 Jul 2025 08:27:49 GMT

Hi,

yes, all is setup and works well when used manually. I can use SPL to update the database table.

i am unable to use the db connect alert action.

i have 3 outputs configured in DBX. Now I am setting up an alert and choose the db connect alert action. It’s not working. And in my mind it can’t because I have no way to tell it what output to use?

if someone has an dbx alert configured and could share the config that might clear up my confusion.

Kind regards,
Andre

Re: How do you use the Database Connect Alert Action?

Andre_ — Tue, 08 Jul 2025 08:31:01 GMT

The document you linked states in step 5 for creating and alert: “Enter the Output Name. The output name must exist in DB Connect.”

I have no option to enter the output name. Says no parameters required.

Re: How do you use the Database Connect Alert Action?

PrewinThomas — Tue, 08 Jul 2025 08:39:37 GMT

Your DB Connect version?

Re: How do you use the Database Connect Alert Action?

Andre_ — Tue, 08 Jul 2025 08:43:14 GMT

Latest 3.x, haven’t updated to 4.0.0 yet (not a fan of 0s)

Re: How do you use the Database Connect Alert Action?

PrewinThomas — Tue, 08 Jul 2025 09:24:15 GMT

@Andre_

I can see option to enter Output Name with DbConenct version 4. There might be bug/ui issue with your particular 3.x version, not sure.

Also i saw an option by directly editing savedsearches.conf, which i haven't tested. You can try this if you can't upgrade to 4.

After saving your alert, add below entry to your .conf with your db output name

action.db_output = 1
action.db_output.param.output = output_to_test_table

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

Re: How do you use the Database Connect Alert Action?

Andre_ — Tue, 08 Jul 2025 12:23:18 GMT

When you set up the alert - what app are you using? Wondering if it’s a permission issue?
My alert is defined in the search app.

Re: How do you use the Database Connect Alert Action?

Andre_ — Thu, 17 Jul 2025 22:40:20 GMT

I found some more information, when I go:

Apps -> DBX -> search -> save as alert -> I get the Output Name field

but if I go:
Apps -> other app (like Search & Reporting) -> search -> save as alert -> I don't get the Output Name field

Any ideas what that could be?

Kind Regards,
Andre