Splunk DB Connect 2: What is the proper syntax for dbxquery?

[kbecker]

With DBConnect v2, it looks like dbquery was replaced with dbxquery, however, the syntax doesn't appear to be documented. Looking at the python command code, I see it needs a connection and query argument, however, when these are supplied, the search just runs. This same SQL query works fine from the SQL query page and with DBConnect v1.

| dbxquery connection=CONNECTION query=QUERY   

I tried no quotes, single quotes, and double quotes around the SQL query

[ashish_ray]

"dbxquery" command is working in DBconnect ver-2 not in DB-connect =< ver-1.1.7 that I have tested.

The command syntax is bit awkward any space need to reconverted hex-code:

Working command:
| dbxquery query="SELECT%20*%20FROM%20customers" connection="Northwind_products"

[kbecker · Accepted solution]

I have found dbxquery does work. The downside is you have to replace spaces and special characters with the hex equivalent (See below)...

| dbxquery connection=XYZ query="SELECT%20Location,%20NodeID,%20Caption,%20Description,%20IP_Address%20FROM%20MyTable%20WHERE%20(Caption%20LIKE%20%27%-P0%%27)%20OR%20(Caption%20LIKE%20%27%A0%%27)"

[araitz]

you%20can%27t%20read%20url%20encoded%20strings%3F!%3F

[landen99]

It has been corrected. Spaces work fine.

[jcoates_splunk]

this is going to be corrected in a future release. In the meantime, you can use urlencode tools or sites to get it right (note that it's got to replace space with %20, not -).

[rutgerthomschut]

@jcoates_splunk any news on when DB Connect v2 queries won't require to be URL encoded any longer?

[peter7431]

Any ideas when this will be corrected?

[BP9906]

I confirm this works, major bummer on this since Splunk has no easy urlencode function, only urldecode.
I plan to use dbxquery for a long dynamic SQL query but I'll have to wait for this to be fixed because I have PullDown modules sending variables and encoding the query partially in URL Encoded format wont suffice.