All Apps and Add-ons

dbquery Syntax Error

harshavrath
Contributor

Hi,

I'm struggling with dbquery syntax, please anyone tell the correct syntax.

I have configured my oracle DB with Splunk DBX, I'm able to view tables of my DB but I'm unable to query them.

Any Help is Appreciated,

Thanks.

Tags (3)
0 Karma
1 Solution

aelliott
Motivator

Syntax
dbquery

sql-database: Name of a configured database listed in the database.conf file.

dbquery-sql:
The SELECT query string to execute.
Format options:
"databaseName"
db=databaseName
database=databaseName

| dbquery "mysql" "SELECT * FROM hosts WHERE active = 1" limit=25

http://docs.splunk.com/Documentation/DBX/1.1.3/DeployDBX/Commands

View solution in original post

aelliott
Motivator

Syntax
dbquery

sql-database: Name of a configured database listed in the database.conf file.

dbquery-sql:
The SELECT query string to execute.
Format options:
"databaseName"
db=databaseName
database=databaseName

| dbquery "mysql" "SELECT * FROM hosts WHERE active = 1" limit=25

http://docs.splunk.com/Documentation/DBX/1.1.3/DeployDBX/Commands

aelliott
Motivator

they don't match what's in the database?
If so you may want to have a separate post since we got the query running 🙂

harshavrath
Contributor

but the date column is not correct.

0 Karma

harshavrath
Contributor

Thanks its working now, because of semi-colon at the end of the stmt it was giving an error.

0 Karma

harshavrath
Contributor

hey I'm leaving now will post the error message tomorrow that i'm getting.

0 Karma

aelliott
Motivator

what error is it giving you?

harshavrath
Contributor

I tried the normal select stmt
Select * from Table_Name its not working

0 Karma

aelliott
Motivator

in the db query page you just put in your query, you select a database name and write your normal query.
So just the SELECT * FROM TABLE-NAME , or select top 1000 * from TABLE-NAME

harshavrath
Contributor

what's the difference in Querying from the Search page & DB Query Page..?

0 Karma

harshavrath
Contributor

| dbquery "DB___NAME" "SELECT * FROM TABLE-NAME" LIMIT=1000
this does not work in DB Query Page but works fine in the normal Search Page.

0 Karma

aelliott
Motivator

do you have an example of something that does not work?

0 Karma

harshavrath
Contributor

This syntax works fine from the search page of DBX but it does not work in DB Query.

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...