I am using DB Connect 2 to pull information from database into a lookup table. It is setup correctly but the lookup table is not available in Search app. It looks like it is only available under the DB Connect App. What do I have to do to make it available globally? I found the lookup definition created by DB Connect and changed the permission to global but I still get the following error when I try to use the lookup table in Search App:
Error in 'lookup' command: The lookup table 'db_connect_CarrierLookup' does not exist.
If I run the exact search under DB Connect V2 app it works.
Okay, thanks in part to the comment by @jcoates, I was able to get it working.
There are 3 components of a DB lookup (4 for automatic lookups):
dblookup.py(the python script which does the heavy lifting)
In order to get DB lookups defined in other apps to work, you need (at minimum):
Here's how I did it.
Add the following stanza to
$SPLUNK_HOME/etc/apps/splunk_app_db_connect/metadata/local.meta to export the
dblookup.py script globally (I couldn't figure out a way to do this via the web interface)
[searchscripts/dblookup.py] export = system
(At this point, I restarted Splunk)
I used the GUI and selected the app context at the end of the wizard. If you've defined it in the wrong place, you should move the lookup definition via the DB Connect app instead of via the normal Splunk settings page (e.g. edit the config and change the app context), because there's also an input that needs to be moved.
Defining the DB lookup will create the following:
[<lookup name>] external_cmd = dblookup.py <lookup name> fields_list = <comma-separated list of fields you've defined>
[mi_lookup://<lookup name>] ... # there's about 16 entries under this stanza. It contains the raw SQL for the lookup, as well as some other bits and pieces used by the gui
[transforms/<lookup name>] ...
If you've defined the lookup as an automatic lookup, you'll also have entries in
$SPLUNK_HOME/etc/apps//local/props.conf like so:
[<spec>] LOOKUP-db_connect_<lookup name> = <lookup name> <field> AS <alias> OUTPUTNEW <field>...
[props/<props_spec>/LOOKUP-db_connect_<lookup name>] .... # note: setting export = system here is optional. The automatic lookups will work if searches are run from within your app context.
You can do this via the settings page in Splunk (you want the lookup definition, not the lookup table).
[transforms/<lookup name>] export = system ... # other stuff already added by Splunk
Try these steps
1) Go to Settings->Lookups -> Lookup table files, change the App context to DB Connect and locate your lookup table.
2) In the right most column Actions, click on Move for the record of your lookup table and select Search as application and click on Move.
3) You can see the object moved to Search apps and App context is changed to Search. Optionally, you can change it's Sharing to All apps (by clicking on Permissions under Sharing column).
DB Connect looks more and more useless every time I try to use it. I had issues before with using DB Connect with outputting data from Splunk - now it looks like lookup using DB Connect is also useless.
According to Splunk Support any data pulled into Splunk using DB Lookup is only available while you are in the DB Connect App context so Lookup tables created by DB Lookup are not available to be used ins searches or alerts or dashboards outside of DB Connect App.
How useless is this feature. If I am importing data using DB Connect to a lookup table it should be obvious that I want to use it in Search App or a dashboard I created under Search App or an alert I setup. What use is it to anyone if it can only be seen under the DB Connect App.
Same question as above that which local.meta file are you talking about? If you are talking about the user local.meta then I have to note that we are using LDAP and have lots of users and cannot really go and create local.meta for each user. There really should be a better solution for this.