All Apps and Add-ons

Fetching search strings from database.

anuj1630
New Member

Hi,

I am having a RDBMS connected to Splunk via DB Connect. Inside that RDMS there is a table which stores queries that I have to excecute on splunk. For example: one row is like this
Id Search_String
1 index="XYZ" sourcetype=ABC | convert ctime(_time) as Time timeformat="%U" | stats dc(source) by Time

So my requirement is, I have to fetch this search string from my DB (which I am able todo using DBConnect) and automatically execute on Splunk (which I don't know how to do) to generate report.

Is it possible to do? If yes, then how to do it. Since I am beginner on Splunk, please guide me on this.

0 Karma

niketn
Legend

@anuj1630, This seems to be a duplicate of https://answers.splunk.com/answers/561370/execution-of-search-strings-stored-in-an-external.html

Is your intent to execute only one query at a time? If so,

Step 1) You can feed your dbxquery to populate a table with two columns Id and Search_String (PS: In order to mock the data from Database, I have used makeresults, you can use your current query instead).

Step 2) You can create table <drilldown> to create queryString with the query fetched from the Database Search using $row.Search_String$ token.

Step 3) Finally use the $queryString$ token in the other search that you want to execute. PS: I have included a Time input control with `tokTime, to ensure that the second search run for required duration of time.

<form>
  <label>Dummy Dashboard</label>
  <fieldset submitButton="false">
    <input type="time" token="tokTime">
      <label>Select Time Range</label>
      <default>
        <earliest>-30d@d</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
| eval Id=1
| eval Search_String="index=\"_internal\" sourcetype=\"splunkd\" | convert ctime(_time) as Time timeformat=\"%U\" | stats dc(component) by Time"
| append [| makeresults
| eval Id=2
| eval Search_String="index=\"_internal\" sourcetype=\"splunkd\" | convert ctime(_time) as Time timeformat=\"%U\" | stats dc(group) by Time"]
| fields - _time</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <set token="queryString">$row.Search_String$</set>
        </drilldown>
      </table>
    </panel>
  </row>
  <row depends="$queryString$">
    <panel>
      <table>
        <search>
          <query>
          $queryString$
        </query>
        <earliest>$tokTime.earliest$</earliest>
        <latest>$tokTime.latest$</latest>
        </search>
      </table>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...