All Apps and Add-ons

Splunk DB Connect 2: What is the proper syntax for dbxquery?

Communicator

With DBConnect v2, it looks like dbquery was replaced with dbxquery, however, the syntax doesn't appear to be documented. Looking at the python command code, I see it needs a connection and query argument, however, when these are supplied, the search just runs. This same SQL query works fine from the SQL query page and with DBConnect v1.

| dbxquery connection=CONNECTION query=QUERY   

I tried no quotes, single quotes, and double quotes around the SQL query

1 Solution

Communicator

I have found dbxquery does work. The downside is you have to replace spaces and special characters with the hex equivalent (See below)...

| dbxquery connection=XYZ query="SELECT%20Location,%20NodeID,%20Caption,%20Description,%20IP_Address%20FROM%20MyTable%20WHERE%20(Caption%20LIKE%20%27%-P0%%27)%20OR%20(Caption%20LIKE%20%27%A0%%27)"

View solution in original post

New Member

"dbxquery" command is working in DBconnect ver-2 not in DB-connect =< ver-1.1.7 that I have tested.

The command syntax is bit awkward any space need to reconverted hex-code:

Working command:
| dbxquery query="SELECT%20*%20FROM%20customers" connection="Northwind_products"

0 Karma

Communicator

I have found dbxquery does work. The downside is you have to replace spaces and special characters with the hex equivalent (See below)...

| dbxquery connection=XYZ query="SELECT%20Location,%20NodeID,%20Caption,%20Description,%20IP_Address%20FROM%20MyTable%20WHERE%20(Caption%20LIKE%20%27%-P0%%27)%20OR%20(Caption%20LIKE%20%27%A0%%27)"

View solution in original post

Splunk Employee
Splunk Employee

you%20can%27t%20read%20url%20encoded%20strings%3F!%3F

0 Karma

Motivator

It has been corrected. Spaces work fine.

Splunk Employee
Splunk Employee

this is going to be corrected in a future release. In the meantime, you can use urlencode tools or sites to get it right (note that it's got to replace space with %20, not -).

@jcoates_splunk any news on when DB Connect v2 queries won't require to be URL encoded any longer?

0 Karma

Explorer

Any ideas when this will be corrected?

0 Karma

Builder

I confirm this works, major bummer on this since Splunk has no easy urlencode function, only urldecode.
I plan to use dbxquery for a long dynamic SQL query but I'll have to wait for this to be fixed because I have PullDown modules sending variables and encoding the query partially in URL Encoded format wont suffice.

0 Karma