DB Connect Time-Based lookup

[kranzrm]

Is there any way to create a time-based database lookup with DBConnect 3.11?

I don't see the option within the GUI and can't find a way to customize the lookup SQL query since WHERE field=value appears to be appended to the lookup SQL.

If this can't be done with the GUI, is there a way to do this by creating a stored procedure with the lookup logic and passing the values with the dbxquery command?

This related question referred to an older version of DBConnect.

[jcoates]

are you trying to pass a time to the lookup, or get one back from it?

[kranzrm]

I am passing a time to the lookup. The problem is that the lookup query I define is wrapped in a subselect statement. I cannot find any way to prevent dbxlookup to not wrap my lookup query.

[jcoates]

is the data in the database changing rapidly, or relatively static? If it's static, can you use dbxquery to create a Splunk lookup instead?

[kranzrm]

The data is rapidly changing (hourly ip to hostname information). I was looking to use an external database due to volume and churn.

[jcoates]

this is a case where the lookup wrapping is necessary to prevent killing performance. Splunk gives dbxlookup a result row at a time, and if it then does a single select statement for that row, things will become sad. Ideally DB Connect would starve the JDBC pool and start throwing errors before hurting the database's performance, but ain't no one going to be happy.

Instead, the command batches some rows and constructs a statement of the form SELECT values FROM table WHERE keys IN (key1, key2, key3).

It sounds like what's throwing it off in your case is the formatting of the key values, so I'd look for ways to change that.

[kranzrm]

Is there a way to customize the query? I'm trying to create a time-based lookup with DBConnect. Any suggestions?

Also, The key values are integer time stamps and string IP addresses. Does DBConnect send the parameters as their Splunk data types? Is there a way to specify this? Or, does it make all parameters strings?

[jcoates]

Not with the shipping product. Sounds like you've hit the point where opening a support ticket is your best bet, you're asking for product change now.