Automate Indexing

[harshavrath]

Hi,

I have installed Splunk & dbx in windows platform is there a way by which i can index my Oracle table records every 12 hours.Can i automate my indexing process.

Any video or doc that i can refer.

Any Help is Appreciated,

Thanks.

[dmaislin_splunk · Accepted solution]

Part of the default documentation for that app: http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Configuredatabasemonitoring

[dmaislin_splunk]

http://docs.splunk.com/Documentation/Splunk/6.0.3/SearchReference/Outputlookup

[harshavrath]

can you provide an example or link as how to use the outputlookup command.

[dmaislin_splunk]

Now just use the outputlookup search command once the data is indexed to create the lookup table with a scheduled job.

[harshavrath]

the query works
SELECT * FROM table_NM WHERE ROWNUM<=30 AND TRUNC(CREATED_DT) BETWEEN to_date('04-10-2014','mm/dd/yyyy') AND to_date('04-10-2014','mm/dd/yyyy') {{AND $rising_column$ > ?}} ORDER BY CREATED_DT ASC
i was able to index data into splunk.

[dmaislin_splunk]

You did not describe the issue. Just import the data into Splunk, leave the order statement off the query and use Splunk command | sort - CREATED_DT_ASC | outputlookup yourlookuptable.csv

[dmaislin_splunk]

Does the query work when you test it? Does the data show up in Splunk?

[harshavrath]

if i schedule an cron how will i be able to solve the CREATED_DT issue..?

[harshavrath]

this is the query that i use to index data into splunk

[harshavrath]

SELECT * FROM table_NM WHERE ROWNUM<=30 AND TRUNC(CREATED_DT) BETWEEN to_date('04-10-2014','mm/dd/yyyy') AND to_date('04-10-2014','mm/dd/yyyy') {{AND $rising_column$ > ?}} ORDER BY CREATED_DT ASC

[dmaislin_splunk]

You can put it in cron format:

0 0 * * *

Would execute your script at 12 am every day of every week of every month.

A cron statement consists of five parts:

minute
hour
day of month
month
day of week

http://code.tutsplus.com/tutorials/scheduling-tasks-with-cron-jobs--net-8800

[harshavrath]

hi did you refer to "Specify query interval"