All Apps and Add-ons

Splunk DB Connect: Is it possible to use dbxquery results as a variable for local data search?

lasonyadj
New Member

Is it possible to use the results of a dbxquery to be used as a variable for a local search. For example, I want to output data on an hour basis using Splunk DB Connect, but in order to make sure that I am not missing any events that may have occured between data extracts, I want to query my oracle table for the max event time and use that as my "earliest" time. Is this possible?

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@lasonyadj - Did the answer provided by woodcock help provide a working solution to your question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with more feedback. Thanks!

0 Karma

woodcock
Esteemed Legend

Yes, here is a run-anywhere example (try it for All time and notice that it does it only for an hour):

index=_* 
[| makeresults 
| rename _time AS earliest 
| eval earliest=earliest-3600, latest=now() 
| format "" "" "" "" "" "" 
| rex field=search mode=sed "s/\"//g"]

Yours would just switch out makeresults for your dbxquery command and get rid of the earliest=earliest-3600,.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...