All Apps and Add-ons

Splunk DB Connect 2: What is the proper syntax for dbxquery?

kbecker
Communicator

With DBConnect v2, it looks like dbquery was replaced with dbxquery, however, the syntax doesn't appear to be documented. Looking at the python command code, I see it needs a connection and query argument, however, when these are supplied, the search just runs. This same SQL query works fine from the SQL query page and with DBConnect v1.

| dbxquery connection=CONNECTION query=QUERY   

I tried no quotes, single quotes, and double quotes around the SQL query

1 Solution

kbecker
Communicator

I have found dbxquery does work. The downside is you have to replace spaces and special characters with the hex equivalent (See below)...

| dbxquery connection=XYZ query="SELECT%20Location,%20NodeID,%20Caption,%20Description,%20IP_Address%20FROM%20MyTable%20WHERE%20(Caption%20LIKE%20%27%-P0%%27)%20OR%20(Caption%20LIKE%20%27%A0%%27)"

View solution in original post

ashish_ray
New Member

"dbxquery" command is working in DBconnect ver-2 not in DB-connect =< ver-1.1.7 that I have tested.

The command syntax is bit awkward any space need to reconverted hex-code:

Working command:
| dbxquery query="SELECT%20*%20FROM%20customers" connection="Northwind_products"

0 Karma

kbecker
Communicator

I have found dbxquery does work. The downside is you have to replace spaces and special characters with the hex equivalent (See below)...

| dbxquery connection=XYZ query="SELECT%20Location,%20NodeID,%20Caption,%20Description,%20IP_Address%20FROM%20MyTable%20WHERE%20(Caption%20LIKE%20%27%-P0%%27)%20OR%20(Caption%20LIKE%20%27%A0%%27)"

araitz
Splunk Employee
Splunk Employee

you%20can%27t%20read%20url%20encoded%20strings%3F!%3F

0 Karma

landen99
Motivator

It has been corrected. Spaces work fine.

jcoates_splunk
Splunk Employee
Splunk Employee

this is going to be corrected in a future release. In the meantime, you can use urlencode tools or sites to get it right (note that it's got to replace space with %20, not -).

rutgerthomschut
Engager

@jcoates_splunk any news on when DB Connect v2 queries won't require to be URL encoded any longer?

0 Karma

peter7431
Explorer

Any ideas when this will be corrected?

0 Karma

BP9906
Builder

I confirm this works, major bummer on this since Splunk has no easy urlencode function, only urldecode.
I plan to use dbxquery for a long dynamic SQL query but I'll have to wait for this to be fixed because I have PullDown modules sending variables and encoding the query partially in URL Encoded format wont suffice.

0 Karma
Get Updates on the Splunk Community!

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...