dbquery Syntax Error

[harshavrath]

Hi,

I'm struggling with dbquery syntax, please anyone tell the correct syntax.

I have configured my oracle DB with Splunk DBX, I'm able to view tables of my DB but I'm unable to query them.

Any Help is Appreciated,

Thanks.

[aelliott · Accepted solution]

Syntax
dbquery

sql-database: Name of a configured database listed in the database.conf file.

dbquery-sql:
The SELECT query string to execute.
Format options:
"databaseName"
db=databaseName
database=databaseName

| dbquery "mysql" "SELECT * FROM hosts WHERE active = 1" limit=25

http://docs.splunk.com/Documentation/DBX/1.1.3/DeployDBX/Commands

[aelliott]

they don't match what's in the database?
If so you may want to have a separate post since we got the query running 🙂

[harshavrath]

but the date column is not correct.

[harshavrath]

Thanks its working now, because of semi-colon at the end of the stmt it was giving an error.

[harshavrath]

hey I'm leaving now will post the error message tomorrow that i'm getting.

[aelliott]

what error is it giving you?

[harshavrath]

I tried the normal select stmt
Select * from Table_Name its not working

[aelliott]

in the db query page you just put in your query, you select a database name and write your normal query.
So just the SELECT * FROM TABLE-NAME , or select top 1000 * from TABLE-NAME

[harshavrath]

what's the difference in Querying from the Search page & DB Query Page..?

[harshavrath]

| dbquery "DB___NAME" "SELECT * FROM TABLE-NAME" LIMIT=1000
this does not work in DB Query Page but works fine in the normal Search Page.

[aelliott]

do you have an example of something that does not work?

[harshavrath]

This syntax works fine from the search page of DBX but it does not work in DB Query.