All Apps and Add-ons
Highlighted

DB-Connect 3 - dbxlookup with query does not work

Hi fellow Splunkers,
I am trying to use DB-Connect to enrich search results by doing a dbxlookup against a table.

This is my command:

| makeresults
| eval value_i_know_to_be_in_database="218024571471"
| dbxlookup query="SELECT * FROM my_table" connection="my_connection" DATABASE_FIELDNAME as value_i_know_to_be_in_database OUTPUT CONTENT as dbx_content

For all I know this is exactly in line with the documentation. To verify that i did not goof the query i also ran:

| dbxquery query="SELECT * FROM my_table" connection="my_connection" 
| outputlookup dbxtest.csv

This returns results and looks right.
I added it to my previos search like this:

| makeresults
| eval value_i_know_to_be_in_database="218024571471"
| dbxlookup query="SELECT * FROM my_table" connection="my_connection" DATABASE_FIELDNAME as value_i_know_to_be_in_database OUTPUT CONTENT as dbx_content
| lookup dbxtest.csv DATABASE_FIELDNAME as value_i_know_to_be_in_database OUTPUT CONTENT as lookup_content

Now I get the expected value in the lookupcontent field and still nothing in the dbxcontent field.

I have been at this problem for multiple hours now and can't seem to get anywhere. I also tried to use a predefined lookup (which in actual production I can not use because my query needs to be dynamic). Did not work either.

At this point I don`t know what else to try. I have read the docs forward and back, but I can not get anything.

Help me answers.splunk. You are my only hope.

Tags (1)
0 Karma
Highlighted

Re: DB-Connect 3 - dbxlookup with query does not work

New Member

@Dohrendorf_DB

Did you get any help or were able to find any solution?
I am also facing the same issue

0 Karma
Highlighted

Re: DB-Connect 3 - dbxlookup with query does not work

Sadly no. There was no response to this question in any shape or form so far.

For now I solved my problem by running a subsearch with a join, which seems very wrong, but i couldn't solve it any other way.

Please post in here if you find anything.

0 Karma