All Apps and Add-ons

DB connect query field need to create in splunk data

rakesh44
Communicator

Hi Friends,

I have DB connect query which runs from 1 to 7th date of every month.

I need one field to be create in splunk data if query is run out of date from 1 to 7th of every month. Suppose query is re-run manually on 8th then it should create one field in splunk data. Could we create such automation in splunk

I required such arrangement as we are trying to compare count of data injected from database with count of data in splunk. I could not use date as field as data keep changing in mili seconds.

0 Karma

lakshman239
Influencer

you could have a field say | eval query_runTime = _time in your search , which will populate the time and it can be stored in the index. everytime you run, you will have the time (including ms). would this not help?

0 Karma

rakesh44
Communicator

There two things when DB connect query runs it pull data from oracle and put it in splunk Index.
In my case if DB connect query runs it should create one field in splunk Index. Then I would count no fields in splunk.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...