Dynamic dbxlookup query

[BradOH]

We have a weird situation not sure how to work around. Our Splunk instance ingests an audit log which includes events from multiple departments. In our reports, we use DBXLOOKUP to enrich the data in the results.

Unfortunately, although the table names are the same for each department, the database name is different. Is there anyway to create a dynamic dbxlookup to insert a different database name based on the department ID?  (perhaps using a search macro???) 

I'd hate to create a dozen static dblookups for this. Any report changes would need to be updated in all those separate lookups... 😞

Any suggestions would be helpful.  Thanks!

[BradOH]

Thanks for the response, I should clarify.  We don't need to reference a field, just which table to use.  For example, in our log event, we may have:

Event_1, HR, Event details...

Event_2, Engineering...

Event_3, Finance...

Our dbxlookup/query is used to add in details such as UserId in event to UserName from DB. This is just a simple query like 'select UserName from db.Engineering.Users WHERE UserId=XXX'

Unfortunately, the users for each department are in different tables. For example

db.Engineering

db.HR

db.Finance

We've been forced to create individual lookups for each department/region. 

I'm more versed in SPL, but know enough SQL to be dangerous.  Perhaps there is a way in SQL to do this through one query which I'm missing?

I hope that helps clarify the question...

[livehybrid]

Hi @BradOH 

As far as I know, the values sent in the dbxlookup command are intended to be strings so its not possible to send through a reference to a field or a field name for example. 

You wouldnt want to use something like a map command because it would create lots of additional searches which wouldnt be good, so thats off the table.

I will keep digging though and post back if I find any alternative.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing