All Apps and Add-ons

Can I use dbxlookup (db connect 3.1) in data model root search?

clagese
Explorer

I 'm defining some data model and I need to use external lookup on relational db to extend event's data. In classic search I use dbxlookup command of db connect 3.1 but when I use this command on base search of data set in data model I get this error in splunkd:

12-14-2017 11:57:28.197 +0100 ERROR ChunkedExternProcessor - stderr: 11:57:28.195 2169@searchdp-clt-1 [main] INFO  c.splunk.dbx.utils.TrustManagerUtil - action=load_key_manager_succeed
    12-14-2017 11:57:28.581 +0100 ERROR ChunkedExternProcessor - stderr: 11:57:28.579 2169@searchdp-clt-1 [main] INFO  c.s.dbx.command.DbxLookupCommand - action=init_lookup, chunk size is 1000
    12-14-2017 11:57:29.525 +0100 ERROR ChunkedExternProcessor - stderr: 11:57:29.523 2210@searchdp-clt-1 [main] INFO  c.splunk.dbx.utils.TrustManagerUtil - action=load_key_manager_succeed

Example of base search in dataset:

index=dp_api | dbxlookup lookup=lookup_account_list_trackcodes

Moreover dataset list page loading is very very slow and produce same above errors on splunkd log.

Can I use dbxlookup in data model or Is there an alternative method to do db lookup in data model ?

0 Karma

micahkemp
Champion

Datamodel root searches can not contain pipes.

Root event datasets are the most commonly-used type of root data model dataset. Each root event dataset broadly represents a type of event. For example, an HTTP Access root event dataset could correspond to access log events, while an Error event corresponds to events with error messages.
Root event datasets are typically defined by a simple constraint. This constraint is what an experienced Splunk user might think of as the first portion of a search, before the pipe character, commands, and arguments are applied. For example, status > 600 and sourcetype=access_* OR sourcetype=iis* are possible event dataset definitions.

From the documentation.

Your only option here would be if you could make that dbxlookup automatic so that it doesn't have to be placed in the search string. I'm not that familiar with dbconnect, so I don't have an answer regarding the feasibility of doing so.

0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...