Unknown search command 'dbxquery'

[cscaldeira]

Hi. I am trying to use dqxquery following the Splunk DB Connect 2 documentation but I am having no success. http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Commands.

When I try to run dbxquery from Splunk Console it replies back with: "Unknown search command 'dbxquery'."

Anyone knows why?
One more question: To use dbxquery do I have to create DB Input for every single table that I want to use?

Thanks.

[slr]

Is true, by default the dbxquery command only run within the Splunk DB Connect v2 App, but if you go to "Manage Apps" and you change the "Permissions" to "All apps", you will can use it in any other app.

I mislead the second question, sorry: with a DB Input you can use only one "query", but if you use this syntax: SELECT * FROM `DataBase`.`table` you can do any query to any DB that your identity has access. Another option, you can create a new DB Connection with a different default DB, and then use this new connection in a new query/DBinput.

Regards.

[napomokoetle]

Makes sense. Thanks!

[jnussbaum_splun · Accepted solution]

By default, the | dbxquery command will need to be ran from "search" within the Splunk DB Connect v2 App.

[napomokoetle]

I also need to excute the DBXQUERY outside the DB Connect v2 App. Is this at all possible? If so, how does one enable it. I've right many permission configs that didn't help. Thanks!

[cscaldeira]

You mean, I can not use this command on normal Splunk console. Need to use it on Db operations right!
I could use it on DB Input

[tdiestel]

@jnussbaum when you say "By default", does that mean we can change a setting to run |dbxquery from another app? I would love to use the |dbxquery on one of my dashboards that's not in the Splunk DB Connect v2 App and was wondering how to do that.