All Apps and Add-ons

DB Connect Time-Based lookup

kranzrm
Path Finder

Is there any way to create a time-based database lookup with DBConnect 3.11?

I don't see the option within the GUI and can't find a way to customize the lookup SQL query since WHERE field=value appears to be appended to the lookup SQL.

If this can't be done with the GUI, is there a way to do this by creating a stored procedure with the lookup logic and passing the values with the dbxquery command?

This related question referred to an older version of DBConnect.

0 Karma

jcoates
Communicator

are you trying to pass a time to the lookup, or get one back from it?

kranzrm
Path Finder

I am passing a time to the lookup. The problem is that the lookup query I define is wrapped in a subselect statement. I cannot find any way to prevent dbxlookup to not wrap my lookup query.

0 Karma

jcoates
Communicator

is the data in the database changing rapidly, or relatively static? If it's static, can you use dbxquery to create a Splunk lookup instead?

0 Karma

kranzrm
Path Finder

The data is rapidly changing (hourly ip to hostname information). I was looking to use an external database due to volume and churn.

0 Karma

jcoates
Communicator

this is a case where the lookup wrapping is necessary to prevent killing performance. Splunk gives dbxlookup a result row at a time, and if it then does a single select statement for that row, things will become sad. Ideally DB Connect would starve the JDBC pool and start throwing errors before hurting the database's performance, but ain't no one going to be happy.

Instead, the command batches some rows and constructs a statement of the form SELECT values FROM table WHERE keys IN (key1, key2, key3).

It sounds like what's throwing it off in your case is the formatting of the key values, so I'd look for ways to change that.

0 Karma

kranzrm
Path Finder

Is there a way to customize the query? I'm trying to create a time-based lookup with DBConnect. Any suggestions?

Also, The key values are integer time stamps and string IP addresses. Does DBConnect send the parameters as their Splunk data types? Is there a way to specify this? Or, does it make all parameters strings?

0 Karma

jcoates
Communicator

Not with the shipping product. Sounds like you've hit the point where opening a support ticket is your best bet, you're asking for product change now.

0 Karma
Get Updates on the Splunk Community!

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...