Syntax
dbquery
sql-database: Name of a configured database listed in the database.conf file.
dbquery-sql:
The SELECT query string to execute.
Format options:
"databaseName"
db=databaseName
database=databaseName
| dbquery "mysql" "SELECT * FROM hosts WHERE active = 1" limit=25
http://docs.splunk.com/Documentation/DBX/1.1.3/DeployDBX/Commands
Syntax
dbquery
sql-database: Name of a configured database listed in the database.conf file.
dbquery-sql:
The SELECT query string to execute.
Format options:
"databaseName"
db=databaseName
database=databaseName
| dbquery "mysql" "SELECT * FROM hosts WHERE active = 1" limit=25
http://docs.splunk.com/Documentation/DBX/1.1.3/DeployDBX/Commands
they don't match what's in the database?
If so you may want to have a separate post since we got the query running 🙂
but the date column is not correct.
Thanks its working now, because of semi-colon at the end of the stmt it was giving an error.
hey I'm leaving now will post the error message tomorrow that i'm getting.
what error is it giving you?
I tried the normal select stmt
Select * from Table_Name its not working
in the db query page you just put in your query, you select a database name and write your normal query.
So just the SELECT * FROM TABLE-NAME , or select top 1000 * from TABLE-NAME
what's the difference in Querying from the Search page & DB Query Page..?
| dbquery "DB___NAME" "SELECT * FROM TABLE-NAME" LIMIT=1000
this does not work in DB Query Page but works fine in the normal Search Page.
do you have an example of something that does not work?
This syntax works fine from the search page of DBX but it does not work in DB Query.