All Apps and Add-ons

DB Connect Source

AHEARNJ
Explorer

I setup Splunk DB Connect to pull in log files that are stored in a MS SQL database. The logs have a Source column that is being excluded from the search results, since Connect DB makes you set a source type. I even tried to use a Rex and when testing the regular expression on regexr.com it identifies the regex, but some some reason Splunk is identifying the one that was declared in the Connect DB settings. Does anyone know a workaround for this?

0 Karma

woodcock
Esteemed Legend

Just rename the source field inside of your SQL and then rename it back in the post-dbx* part of your SPL. Cake.

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Okay, just look at the SQL. Make sure that it is listing the actual columns...

NOT...

 Select * from mydatabase.mytable 

YES...

Select fieldname1, fieldname2 fieldname3, source, fieldname5 
from mydatabase.mytable 

Then change it to ...

Select fieldname1, fieldname2 fieldname3, source AS someothername, fieldname5 
from mydatabase.mytable 

and the source field should come across under the new name.

0 Karma

Richfez
SplunkTrust
SplunkTrust

Can you provide samples?

The original rows from the DB (or the parts that matter), what displays in an event, and what each of the values should be?

Also, what did you try to do with the rex (like, specifically, even if it's wrong it may help us understand).

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...