All Apps and Add-ons

Splunk DB Connect 2: Why is my SQL count(*) query not working with error "Unrecognized or ambiguous rising column name [mycol] is used."?

Communicator

Hello All,

I am trying to pull the Oracle table into the Splunk. Below is my SQL query:

select count(*) from mytable {{where $rising_column$ > ?}}  

And am giving the Primary ID column name to rising_column field, but am getting the below error:

Unrecognized or ambiguous rising column name [mycol] is used. For Oracle database, qualified column name cannot be used, use "<qualified name> (<alias>)" instead.

Could you please help me on this?

0 Karma

Motivator

Hi,

I think you are trying to pass the Splunk token into SQL select statement, If so the below will help you.

|dbxquery [|stats c | eval query="select count(*) from mytable where fieldname="+$rising_column$ | return query] connection="<connection>" | table *

You can create the query string in a sub search and pass it to the dbx query. Hope this will helps you..

Thanks,
V

0 Karma

Communicator

No, he is comparing the $rising_column$ field with the last value referred by ?

Did you tested what you said?

0 Karma

Motivator
0 Karma

Communicator

Ok thanks for the replies.

But here we are talking about DB Con v2 and not DB Con v1.

Those links are from 2012 and related to DB Con v1, I'm migrating from DB Con v1 to v2.

In v1 I don't have any problems with the statement {{where $rising_column$ > ?}}, only when I'm trying to migrate the Data Inputs to v2.

Regards 🙂

0 Karma

Communicator

Any news on this topic?

Regards

0 Karma

SplunkTrust
SplunkTrust

I think $rising_column$ should be a non-ambiguous column name

Something like column.Name > ?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!