All Apps and Add-ons

Execution of search strings stored in an external DB.

mmukherjee
Explorer

Hi,

I have stored a few search strings in an external DB. I want to automatically fetch and execute those search strings on Splunk. The fetching part is done, but executing those strings automatically after fetching, is something that I have no idea about. Please help.

0 Karma
1 Solution

niketn
Legend

@mmukherjee, I have answered this on https://answers.splunk.com/answers/560814/fetching-search-strings-from-database.html

Please try out and confirm.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@mmukherjee, I have answered this on https://answers.splunk.com/answers/560814/fetching-search-strings-from-database.html

Please try out and confirm.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

Can you explain/add more details for your use case?
You have mentioned "stored a few search strings in an external DB". What are these "search string"? Can you give example? Also what is this external DB? is RDBMS system?
What do you mean by "fetching part is done", have you got the data already in Splunk?
What do you mean by "executing those strings"?

Through DB Connect App you can execute queries/stored procedures in several Databases. Not sure if that is your use case. Please check out the App on Splunkbase and Splunk Documentation:

https://splunkbase.splunk.com/app/2686/
https://docs.splunk.com/Documentation/DBX

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

mmukherjee
Explorer

Okay, let me give a more detailed description.

I have a table called Splunk_query in an external database (RDBMS system). It has three fields namely Id, Scenario and Search String. Here's a sample record from the table:

Id // Scenario // Search String
1 // Test cases executed per week // index="XYZ" sourcetype=ABC | convert ctime(_time) as Time timeformat="%U" | stats dc(source) by Time

So now I need to fetch these search strings one by one and execute them on Splunk. Is it possible?

0 Karma
Get Updates on the Splunk Community!

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...

New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster

Splunk Observability has two new enhancements to make it quicker and easier to troubleshoot slow or frequently ...