All Apps and Add-ons

Splunk DB Connect 2: Why are we getting no results in pivot when using a dbxquery query?

pieterms
New Member

We use the following database query in search mode.

|dbxquery query="SELECT%20*%20FROM%20%60app%60.%60order%60" connection="sqldb" maxrows=100 

When we want to make a pivot for these results, the "count of event object" stays on 0. When I press on the "count of event object" link, the following search qeury will be displayed on screen in search mode again.

(dbxquery query="SELECT%20*%20FROM%20%60app%60.%60order%60" connection="sqldb")  

The pipe character is disappeared so the query doesn't work anymore. How do I solve this problem so we can make pivot visualizations for these queries?

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

that data will have to be indexed to be used with pivot.

0 Karma

pieterms
New Member

How can I index this data?

I think this data already indexed via the Splunk DB Connect 2 - DB Input. The meta data is set in this plugin.

0 Karma

karthikeyan_mac
New Member

I have created the DB Input. Is there another way to index the data?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...