All Apps and Add-ons

Splunk DB Connect 2: How to fetch and read XML data from BLOB and CLOB fields in MS SQL and Oracle database tables?

moshere
Engager

Hi,

We're using Splunk DB Connect 2 on top of our DB (MS SQL server and Oracle DB). In most of our tables, we've BLOB and CLOB fields that contain XML.
I would like to know how we can fetch and read the actual data from these fields?

Thank you in advance,
Moshe

drodman29
Path Finder

So far this is pretty ugly, but only substrings are working for me to extract from a clob.
My system does not understand the XMLType data type. (DBX 3, Java 8 and Oracle JDBC driver for 18C)
This runs...
select DBMS_LOB.substr(a.My_OBJ, 3000 , 1) as MyXML1, DBMS_LOB.substr(a.My_OBJ, 3000 , 3000) as MyXML2 from MyTableWithClob a

0 Karma

xavierashe
Contributor

The answer to this question is more about SQL than Splunk. Here is what I do in Oracle, but you'll want to ask your DBA (I'm not a DBA by far).

SELECT x.object_value.getCLOBVal() FROM XML_TABLE x;

Googling around, here's another way to skin that cat.

select
XMLType( BLOB_COLUMN,
         1 /* this is your character set ID.
                   1 == USASCII */
       ) as XML
from my_table;
0 Karma

srinathd
Contributor

Any answer for this

0 Karma

peterchenadded
Path Finder

You need to use SQL to convert it to a char field

E.g

Select to_char(clob_field) from table

0 Karma
Get Updates on the Splunk Community!

Operationalizing TDIR: Building a More Resilient, Scalable SOC

Optimizing SOC workflows with a unified, risk-based approach to Threat Detection, Investigation, and Response ...

Almost Too Eventful Assurance: Part 1

Modern IT and Network teams still struggle with too many alerts and isolating issues before they are notified. ...

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...