Is there any way to create a time-based database lookup with DBConnect 3.11?
I don't see the option within the GUI and can't find a way to customize the lookup SQL query since
WHERE field=value appears to be appended to the lookup SQL.
If this can't be done with the GUI, is there a way to do this by creating a stored procedure with the lookup logic and passing the values with the
I am passing a time to the lookup. The problem is that the lookup query I define is wrapped in a subselect statement. I cannot find any way to prevent dbxlookup to not wrap my lookup query.
this is a case where the lookup wrapping is necessary to prevent killing performance. Splunk gives dbxlookup a result row at a time, and if it then does a single select statement for that row, things will become sad. Ideally DB Connect would starve the JDBC pool and start throwing errors before hurting the database's performance, but ain't no one going to be happy.
Instead, the command batches some rows and constructs a statement of the form SELECT values FROM table WHERE keys IN (key1, key2, key3).
It sounds like what's throwing it off in your case is the formatting of the key values, so I'd look for ways to change that.
Is there a way to customize the query? I'm trying to create a time-based lookup with DBConnect. Any suggestions?
Also, The key values are integer time stamps and string IP addresses. Does DBConnect send the parameters as their Splunk data types? Is there a way to specify this? Or, does it make all parameters strings?