All Apps and Add-ons

Insert value into SQL table via dbx application

chimbudp
Contributor

Application:

Splunk db connect

Need:

Need to update a value into SQL table via Splunk dashboard

Query to INSERT a value into SQL table:

| dboutput type=insert database=MyDatabase table=MyTable notFound=insert fields=ColumnName as ColumnValue

| dboutput type=insert database=MyDatabase table=MyTable notFound=insert ColumnName1 as ColumnValue1 CoulmnName2 as CoulumnValue2

Received Error :

command="dboutput", com.splunk.util.csv.CSVException: No CSV input



Tried the above 2 queries , but getting the same Error Message for both

I have already made the database.conf settings. Have set the readonly permission to 'False'

What is the mistake i am making here, am i using the correct format for dboutput query ?

Kindly help.

Tags (3)
0 Karma
1 Solution

cucuro
Explorer

I hope that helps.

| dboutput type=sql database=MyDatabase "INSERT INTO MyTable column, column values column, column"

View solution in original post

jwelsh_splunk
Splunk Employee
Splunk Employee

Here is an actual search command I used and validated it worked:

index=main eventtype="wineventlog-security" | table event_id, EventCode | dboutput database=MSSQLSERVER type=sql "INSERT INTO processes (windows_event_id, windows_event_code) VALUES ($event_id$, $EventCode$)"

Hope it helps.

paulalbert11
Explorer

This was very helpful to me. Thanks!!

0 Karma

cucuro
Explorer

I hope that helps.

| dboutput type=sql database=MyDatabase "INSERT INTO MyTable column, column values column, column"

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...