All Apps and Add-ons

Splunk DB Connect 2: What is the proper syntax for dbxquery?

kbecker
Communicator

With DBConnect v2, it looks like dbquery was replaced with dbxquery, however, the syntax doesn't appear to be documented. Looking at the python command code, I see it needs a connection and query argument, however, when these are supplied, the search just runs. This same SQL query works fine from the SQL query page and with DBConnect v1.

| dbxquery connection=CONNECTION query=QUERY   

I tried no quotes, single quotes, and double quotes around the SQL query

1 Solution

kbecker
Communicator

I have found dbxquery does work. The downside is you have to replace spaces and special characters with the hex equivalent (See below)...

| dbxquery connection=XYZ query="SELECT%20Location,%20NodeID,%20Caption,%20Description,%20IP_Address%20FROM%20MyTable%20WHERE%20(Caption%20LIKE%20%27%-P0%%27)%20OR%20(Caption%20LIKE%20%27%A0%%27)"

View solution in original post

ashish_ray
New Member

"dbxquery" command is working in DBconnect ver-2 not in DB-connect =< ver-1.1.7 that I have tested.

The command syntax is bit awkward any space need to reconverted hex-code:

Working command:
| dbxquery query="SELECT%20*%20FROM%20customers" connection="Northwind_products"

0 Karma

kbecker
Communicator

I have found dbxquery does work. The downside is you have to replace spaces and special characters with the hex equivalent (See below)...

| dbxquery connection=XYZ query="SELECT%20Location,%20NodeID,%20Caption,%20Description,%20IP_Address%20FROM%20MyTable%20WHERE%20(Caption%20LIKE%20%27%-P0%%27)%20OR%20(Caption%20LIKE%20%27%A0%%27)"

View solution in original post

araitz
Splunk Employee
Splunk Employee

you%20can%27t%20read%20url%20encoded%20strings%3F!%3F

0 Karma

landen99
Motivator

It has been corrected. Spaces work fine.

jcoates_splunk
Splunk Employee
Splunk Employee

this is going to be corrected in a future release. In the meantime, you can use urlencode tools or sites to get it right (note that it's got to replace space with %20, not -).

rutgerthomschut
Engager

@jcoates_splunk any news on when DB Connect v2 queries won't require to be URL encoded any longer?

0 Karma

peter7431
Explorer

Any ideas when this will be corrected?

0 Karma

BP9906
Builder

I confirm this works, major bummer on this since Splunk has no easy urlencode function, only urldecode.
I plan to use dbxquery for a long dynamic SQL query but I'll have to wait for this to be fixed because I have PullDown modules sending variables and encoding the query partially in URL Encoded format wont suffice.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!