All Apps and Add-ons

Field parsing from dbx connector to MSSQL table

bbegyspotlite
Engager

So I have a legacy error logging system that drops errors into a table with this schema:

CREATE TABLE [dbo].[ErrorLog](
    [ErrorId] [int] IDENTITY(1,1) NOT NULL,
    [CreateDate] [datetime] NOT NULL,
    [Message] [varchar](max) NULL,
    [ServerName] [varchar](50) NULL,
    [ApplicationName] [varchar](50) NULL,
    [StackTrace] [varchar](max) NULL,
    [Url] [nvarchar](500) NULL,
    [Controller] [varchar](100) NULL,
    [Action] [varchar](100) NULL,
    [UserName] [varchar](100) NULL,
    [IP] [varchar](100) NULL,
    [ErrorLevel] [varchar](100) NULL,
    [UserAgent] [nvarchar](500) NULL

I can use the dbx connector to get splunk to see the rows, but my parsing is way off. I tried selecting csv with headers, csv and anything else I can think of.

Among my issues, I'm getting the database server as "host" instead of the contents of the "serverName" field.

I could do something horriffic like

"SELECT 'host=' + ServerName+ 'SEVERITY=' + errorSeverity AS FullRowText FROM dbo.ErrorLog"

and then regex the single line that comes out, but that seems like a square peg solution.

Is there a "using dbx connector to get for n00bs" guide that I should have read before posting?

Tags (3)
0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

once you retrieved the results, in the splunk search you can use an eval to rename the fields.

mydbxsearch | eval host=ServerName

View solution in original post

yannK
Splunk Employee
Splunk Employee

once you retrieved the results, in the splunk search you can use an eval to rename the fields.

mydbxsearch | eval host=ServerName

bbegyspotlite
Engager

Accepting even though I ended up just bypassing the database, which was generated from log4net in the first place. Thanks.

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...