Execution of search strings stored in an external DB.

[mmukherjee]

Hi,

I have stored a few search strings in an external DB. I want to automatically fetch and execute those search strings on Splunk. The fetching part is done, but executing those strings automatically after fetching, is something that I have no idea about. Please help.

[niketn · Accepted solution]

@mmukherjee, I have answered this on https://answers.splunk.com/answers/560814/fetching-search-strings-from-database.html

Please try out and confirm.

[niketn]

Can you explain/add more details for your use case?
You have mentioned "stored a few search strings in an external DB". What are these "search string"? Can you give example? Also what is this external DB? is RDBMS system?
What do you mean by "fetching part is done", have you got the data already in Splunk?
What do you mean by "executing those strings"?

Through DB Connect App you can execute queries/stored procedures in several Databases. Not sure if that is your use case. Please check out the App on Splunkbase and Splunk Documentation:

https://splunkbase.splunk.com/app/2686/
https://docs.splunk.com/Documentation/DBX

[mmukherjee]

Okay, let me give a more detailed description.

I have a table called Splunk_query in an external database (RDBMS system). It has three fields namely Id, Scenario and Search String. Here's a sample record from the table:

Id // Scenario // Search String
1 // Test cases executed per week // index="XYZ" sourcetype=ABC | convert ctime(_time) as Time timeformat="%U" | stats dc(source) by Time

So now I need to fetch these search strings one by one and execute them on Splunk. Is it possible?