We use the following database query in search mode.
|dbxquery query="SELECT%20*%20FROM%20%60app%60.%60order%60" connection="sqldb" maxrows=100
When we want to make a pivot for these results, the "count of event object" stays on 0. When I press on the "count of event object" link, the following search qeury will be displayed on screen in search mode again.
(dbxquery query="SELECT%20*%20FROM%20%60app%60.%60order%60" connection="sqldb")
The pipe character is disappeared so the query doesn't work anymore. How do I solve this problem so we can make pivot visualizations for these queries?
How can I index this data?
I think this data already indexed via the Splunk DB Connect 2 - DB Input. The meta data is set in this plugin.