- Apps & Add-ons
- :
- All Apps and Add-ons
- :
- All Apps and Add-ons
- :
- Re: DB Connect Time-Based lookup
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
DB Connect Time-Based lookup
Is there any way to create a time-based database lookup with DBConnect 3.11?
I don't see the option within the GUI and can't find a way to customize the lookup SQL query since WHERE field=value appears to be appended to the lookup SQL.
If this can't be done with the GUI, is there a way to do this by creating a stored procedure with the lookup logic and passing the values with the dbxquery command?
This related question referred to an older version of DBConnect.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
are you trying to pass a time to the lookup, or get one back from it?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am passing a time to the lookup. The problem is that the lookup query I define is wrapped in a subselect statement. I cannot find any way to prevent dbxlookup to not wrap my lookup query.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
is the data in the database changing rapidly, or relatively static? If it's static, can you use dbxquery to create a Splunk lookup instead?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The data is rapidly changing (hourly ip to hostname information). I was looking to use an external database due to volume and churn.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
this is a case where the lookup wrapping is necessary to prevent killing performance. Splunk gives dbxlookup a result row at a time, and if it then does a single select statement for that row, things will become sad. Ideally DB Connect would starve the JDBC pool and start throwing errors before hurting the database's performance, but ain't no one going to be happy.
Instead, the command batches some rows and constructs a statement of the form SELECT values FROM table WHERE keys IN (key1, key2, key3).
It sounds like what's throwing it off in your case is the formatting of the key values, so I'd look for ways to change that.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is there a way to customize the query? I'm trying to create a time-based lookup with DBConnect. Any suggestions?
Also, The key values are integer time stamps and string IP addresses. Does DBConnect send the parameters as their Splunk data types? Is there a way to specify this? Or, does it make all parameters strings?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Not with the shipping product. Sounds like you've hit the point where opening a support ticket is your best bet, you're asking for product change now.
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
