All Apps and Add-ons

DB Connect Time-Based lookup

Path Finder

Is there any way to create a time-based database lookup with DBConnect 3.11?

I don't see the option within the GUI and can't find a way to customize the lookup SQL query since WHERE field=value appears to be appended to the lookup SQL.

If this can't be done with the GUI, is there a way to do this by creating a stored procedure with the lookup logic and passing the values with the dbxquery command?

This related question referred to an older version of DBConnect.

0 Karma

Communicator

are you trying to pass a time to the lookup, or get one back from it?

Path Finder

I am passing a time to the lookup. The problem is that the lookup query I define is wrapped in a subselect statement. I cannot find any way to prevent dbxlookup to not wrap my lookup query.

0 Karma

Communicator

is the data in the database changing rapidly, or relatively static? If it's static, can you use dbxquery to create a Splunk lookup instead?

0 Karma

Path Finder

The data is rapidly changing (hourly ip to hostname information). I was looking to use an external database due to volume and churn.

0 Karma

Communicator

this is a case where the lookup wrapping is necessary to prevent killing performance. Splunk gives dbxlookup a result row at a time, and if it then does a single select statement for that row, things will become sad. Ideally DB Connect would starve the JDBC pool and start throwing errors before hurting the database's performance, but ain't no one going to be happy.

Instead, the command batches some rows and constructs a statement of the form SELECT values FROM table WHERE keys IN (key1, key2, key3).

It sounds like what's throwing it off in your case is the formatting of the key values, so I'd look for ways to change that.

0 Karma

Path Finder

Is there a way to customize the query? I'm trying to create a time-based lookup with DBConnect. Any suggestions?

Also, The key values are integer time stamps and string IP addresses. Does DBConnect send the parameters as their Splunk data types? Is there a way to specify this? Or, does it make all parameters strings?

0 Karma

Communicator

Not with the shipping product. Sounds like you've hit the point where opening a support ticket is your best bet, you're asking for product change now.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!