All Apps and Add-ons

Automate Indexing

harshavrath
Contributor

Hi,

I have installed Splunk & dbx in windows platform is there a way by which i can index my Oracle table records every 12 hours.Can i automate my indexing process.

Any video or doc that i can refer.

Any Help is Appreciated,

Thanks.

Tags (3)
0 Karma
1 Solution

dmaislin_splunk
Splunk Employee
Splunk Employee

harshavrath
Contributor

can you provide an example or link as how to use the outputlookup command.

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

Now just use the outputlookup search command once the data is indexed to create the lookup table with a scheduled job.

0 Karma

harshavrath
Contributor

the query works
SELECT * FROM table_NM WHERE ROWNUM<=30 AND TRUNC(CREATED_DT) BETWEEN to_date('04-10-2014','mm/dd/yyyy') AND to_date('04-10-2014','mm/dd/yyyy') {{AND $rising_column$ > ?}} ORDER BY CREATED_DT ASC
i was able to index data into splunk.

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

You did not describe the issue. Just import the data into Splunk, leave the order statement off the query and use Splunk command | sort - CREATED_DT_ASC | outputlookup yourlookuptable.csv

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

Does the query work when you test it? Does the data show up in Splunk?

0 Karma

harshavrath
Contributor

if i schedule an cron how will i be able to solve the CREATED_DT issue..?

0 Karma

harshavrath
Contributor

this is the query that i use to index data into splunk

0 Karma

harshavrath
Contributor

SELECT * FROM table_NM WHERE ROWNUM<=30 AND TRUNC(CREATED_DT) BETWEEN to_date('04-10-2014','mm/dd/yyyy') AND to_date('04-10-2014','mm/dd/yyyy') {{AND $rising_column$ > ?}} ORDER BY CREATED_DT ASC

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

You can put it in cron format:

0 0 * * *

Would execute your script at 12 am every day of every week of every month.

A cron statement consists of five parts:

minute
hour
day of month
month
day of week

http://code.tutsplus.com/tutorials/scheduling-tasks-with-cron-jobs--net-8800

0 Karma

harshavrath
Contributor

hi did you refer to "Specify query interval"

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...