All Apps and Add-ons

View contents of a database lookup

redc
Builder

I want to use a database lookup to populate a Pulldown module.

Is there a way to output the contents of a database lookup? With a static CSV file lookup, I can use | inputlookup filename.csv and it'll show me all the contents of the CSV file.

I want to be able to do the same thing with a database lookup, but | inputlookup lookupname returns an error: "The lookup table 'lookupname' is invalid."

| lookup lookupname demands field names: "Error in 'lookup' command: Must specify one or more lookup fields."

sideview
SplunkTrust
SplunkTrust

Strictly speaking, you cannot take a database lookup and use the inputlookup command to get you the "rows" of the lookup.

However you could certainly use the dbquery command to do so. Just use the same SQL syntax as your lookup, or do SELECT * FROM the same table as your lookup, and you'll be good to go.

eg | dbquery someDatabase limit=10000 "select * from someTable"

0 Karma

sideview
SplunkTrust
SplunkTrust

I think this is actually a good question to ask, but it's a separate question and better answered by someone more involved with DBConnect's development. Can you post it separately? For the record, I doubt that the database lookup caches the lookup rows locally and I don't see any mention of such functionality in the docs.

0 Karma

redc
Builder

Okay, that brings up the question: when piping a command to lookup to do a database lookup, e.g.,

| loadjob MyJob | lookup MyLookupName MyLookupField as MyField OUTPUT MyLookupField2

Is the lookup literally running out to SQL Server in real-time, or does it run it real-time the first time and then cache the results for later use?

(In this case, using dbquery to populate the pulldown is not ideal because of the customizable/fluid nature of the form. I'm trying to be as dynamic as possible and use ValueSetter modules to control the order of Pulldowns. I know, it's weird.)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...