Splunk DB Connect 1 and Add-on for JIRA: Is there a way to use both dbquery and jirarest commands in the same search?

[mrfredman]

Hi,

I was hoping to pull data from two different databases. One is a postgres database I access using the dbquery app and one is a JIRA database that I access using the JIRA app.

Whenever I try to mix the two I get an error saying that the jirarest/dbquery must be the first command of a search.

Is there any way to use both commands in the same search? If not, are there any workarounds?

[martin_mueller · Accepted solution]

Try something along these lines:

| dbquery "foo" "bar" | append [jirarest whatever parameters it needs] | ...

[Flynt]

There are also ways to pass values from one search to another using the Map command. For example if your dbquery passes a JIRA key in a result.

|dbquery "foo" "bar"|map search="|jirarest jqlsearch \"key=$JIRAKEYFIELDFROMDBQUERY$\" "

Note that the map search should have the double quotes escaped and that the map command will only return results from its search and not the dbquery search in this instance. There are also ways to pass a multitude of values from dbquery to jirarest using the built in batch option in jirarest.

[martin_mueller]

How should one pass a value to the other in your example? Who to whom? What value? From where? Used where?
So many questions...

In general, the inner subsearch passes its results to the command that ran it. In my example, the jirarest subsearch passes its results to the append command. Other examples include searching for something in a subsearch and using its results as a filter for the main search.

[mrfredman]

That did the trick. Thanks!

New question leading off of that one.

Is it possible to pass values between the two?

Example:
|dbquery "foo"| append [jirarest jqlsearch "project="foo"]