Syntax for dboutput

[richgalloway]

I'm attempting to update a MySQL table using dboutput. I have an output stanza defined to simplify my searches. If I use the following search command where 'myupdate' is my output stanza name:

...| dboutput myUpdate IPAddress NetAddress ComputerName Manufacturer Model

I get this error message:

"Error in 'dboutput' command: command="dboutput", Missing mandatory option: type (Usage: dboutput ([dboutput-stanza] | type=<insert|update> database=<database> table=<table> [notFound=<ignore|fail|insert>] (<field> [as column]|*)+) )"

It would seem I am not specifying dboutput-stanza correctly. Can anyone set me straight? Or is this a bug in dboutput?

[richgalloway · Accepted solution]

The dboutput command changed in DBX 1.1 to not allow output stanzas. The complete syntax is now documented in http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Commands#dboutput.

[cramasta]

you need to list as the fields like below. I believe it works like field1(name in splunk results) AS field1(column name in db)

| dboutput type=insert database=mydb table=mytable key=somekey field1 AS field1 field2 AS field2

[richgalloway]

Thanks, cramasta, but I think I wasn't clear about my problem. The dboutput usage string says it takes either an output-stanza name or a set of arguments (type, database, etc.). I'm trying to do the former and it's not being accepted.