How to set up a Splunk DB Connect 2 Lookup/Input Update

[nikkkc]

Hi guys,

Is it possible to use the DB Connect lookup like inputlookup? I do not need to join the lookup data with other events and the data should always be up to date, as is always the case in the external database. This is why I don't want to use the input, because it is not possible to update the indexed data, right? I hope someone can follow me.

In my case I have to illustrate data from an external database on a Splunk dashboard. The external data is triggered from another application and the view should always be up to date. Old records are useless and annoying in my query.

Thank you so much!
cheers

[javiergn]

Take a look at this:

http://docs.splunk.com/Documentation/DBX/2.1.3/DeployDBX/Createandmanagedatabaseinputs#Use_database_...

Or this:

http://docs.splunk.com/Documentation/DBX/2.1.3/DeployDBX/Commands

[nikkkc]

sorry i read this but it didnt answer my question...

[javiergn]

Is it possible to use the db connect lookup like inputlookup? I do not need to join the lookup data with other events and the data should always be up to date, as is always the case in the external database

Yes, take a look again at the dbxquery command again and focus on the examples. There's no inputlookup command, it's called dbxquery instead. For instance, your query could be:

| dbxquery query="SELECT * FROM tableFoo" connection="FooBar"
| do something else

That's assuming you are running DB Connect 2. If that's not your case you can always use dbquery instead:

http://docs.splunk.com/Documentation/DBX/1.0.11/DeployDBX/Commands

Let me know if that helps.

[javiergn]

Hi @nikkc, please don't forget to mark it as answered if you are happy with the response so that others can benefit from it.

Otherwise it'll look as unanswered forever and ever and ever...