Fetching search strings from database.

[anuj1630]

Hi,

I am having a RDBMS connected to Splunk via DB Connect. Inside that RDMS there is a table which stores queries that I have to excecute on splunk. For example: one row is like this
Id Search_String
1 index="XYZ" sourcetype=ABC | convert ctime(_time) as Time timeformat="%U" | stats dc(source) by Time

So my requirement is, I have to fetch this search string from my DB (which I am able todo using DBConnect) and automatically execute on Splunk (which I don't know how to do) to generate report.

Is it possible to do? If yes, then how to do it. Since I am beginner on Splunk, please guide me on this.

[niketn]

@anuj1630, This seems to be a duplicate of https://answers.splunk.com/answers/561370/execution-of-search-strings-stored-in-an-external.html

Is your intent to execute only one query at a time? If so,

Step 1) You can feed your dbxquery to populate a table with two columns Id and Search_String (PS: In order to mock the data from Database, I have used makeresults, you can use your current query instead).

Step 2) You can create table <drilldown> to create queryString with the query fetched from the Database Search using $row.Search_String$ token.

Step 3) Finally use the $queryString$ token in the other search that you want to execute. PS: I have included a Time input control with `tokTime, to ensure that the second search run for required duration of time.

<form>
  <label>Dummy Dashboard</label>
  <fieldset submitButton="false">
    <input type="time" token="tokTime">
      <label>Select Time Range</label>
      <default>
        <earliest>-30d@d</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
| eval Id=1
| eval Search_String="index=\"_internal\" sourcetype=\"splunkd\" | convert ctime(_time) as Time timeformat=\"%U\" | stats dc(component) by Time"
| append [| makeresults
| eval Id=2
| eval Search_String="index=\"_internal\" sourcetype=\"splunkd\" | convert ctime(_time) as Time timeformat=\"%U\" | stats dc(group) by Time"]
| fields - _time</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <set token="queryString">$row.Search_String$</set>
        </drilldown>
      </table>
    </panel>
  </row>
  <row depends="$queryString$">
    <panel>
      <table>
        <search>
          <query>
          $queryString$
        </query>
        <earliest>$tokTime.earliest$</earliest>
        <latest>$tokTime.latest$</latest>
        </search>
      </table>
    </panel>
  </row>
</form>