I have a lookup table with a list of customers and database names
customer.csv loaded into Splunk
I have to do a dblookup using the db_name fetched from customer.csv
|dbquery $db_name$ "SELECT name, duration FROM tab1"
$db_name$ needs to be fetched form customer.csv
I got it working..
Created a saved search for the db_lookup as shown below.
|dbquery $schema_name$ "SELECT name, duration FROM tab1"
save this search as as db_lookup_test
Create a new Saved Search will pass in the parameter schema_name as shown below :
| savedsearch db_lookup_test [|inputlookup customer.csv |eval schema_name=db_info | return schema_name]
|inputlookup customer.csv | eval schema_name=db_name |dbquery $schema_name$ "SELECT name, duration FROM tab1"
This is what I am trying to do. I need to get the schema_name dynamically from another lookup