All Apps and Add-ons

Syntax for dboutput

richgalloway
SplunkTrust
SplunkTrust

I'm attempting to update a MySQL table using dboutput. I have an output stanza defined to simplify my searches. If I use the following search command where 'myupdate' is my output stanza name:

...| dboutput myUpdate IPAddress NetAddress ComputerName Manufacturer Model

I get this error message:

"Error in 'dboutput' command: command="dboutput", Missing mandatory option: type (Usage: dboutput ([dboutput-stanza] | type=<insert|update> database=<database> table=<table> [notFound=<ignore|fail|insert>] (<field> [as column]|*)+) )"

It would seem I am not specifying dboutput-stanza correctly. Can anyone set me straight? Or is this a bug in dboutput?

---
If this reply helps you, Karma would be appreciated.
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The dboutput command changed in DBX 1.1 to not allow output stanzas. The complete syntax is now documented in http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Commands#dboutput.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The dboutput command changed in DBX 1.1 to not allow output stanzas. The complete syntax is now documented in http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Commands#dboutput.

---
If this reply helps you, Karma would be appreciated.
0 Karma

cramasta
Builder

you need to list as the fields like below. I believe it works like field1(name in splunk results) AS field1(column name in db)

| dboutput type=insert database=mydb table=mytable key=somekey field1 AS field1 field2 AS field2

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Thanks, cramasta, but I think I wasn't clear about my problem. The dboutput usage string says it takes either an output-stanza name or a set of arguments (type, database, etc.). I'm trying to do the former and it's not being accepted.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...