All Apps and Add-ons

dbxquery returns statistics instead of events for subquery

Path Finder

Hello,

I want to:
- run a search for specific syslog messages
- filter out all those which have a corresponding field in mysql table column

I wanted to do subsearch like:
host="10.62.140.64" Field1 NOT []
and put inside [] my |dbxquery

But then noticed that dbxquery is not returning any events which could be used for subsearch but statistics only.
Can i use dbquery for subsearch ? (to filter out my main syslog search) ? Could you provide any example ?

Thanks,
Michal

Tags (1)
0 Karma

Path Finder

Thank you Somesoni2,

It does not work for me. My final search:

host="10.62.140.64" CISE_Profiler EndpointMatchedPolicy=Workstation NOT [|dbxquery query="SELECT mac FROM endpoints.endpoints" connection="MYSQL" shortnames=true | fields - _* | rename mac as EndPointMACAddress | table EndPointMACAddress]

The first part: "host="10.62.140.64" CISE_Profiler EndpointMatchedPolicy=Workstation" is returning syslog message with "EndpointMacAddress=00:50:B6:11:EA:CE". The second part "|dbxquery query="SELECT mac FROM endpoints.endpoints" connection="MYSQL" shortnames=true | fields - _* | rename mac as EndPointMACAddress | table EndPointMACAddress" is returning the table with EndPointMACAddress column and one of the values is 00:50:B6:11:EA:CE.

Why is that happening ?
The search like this:
host="10.62.140.64" CISE_Profiler EndpointMatchedPolicy=Workstation NOT [00:50:B6:11:EA:CE] is working fine. So it is something wrong with dbxquery conjunction....

Thanks,
Michal

0 Karma

Revered Legend

Yes, the subsearch with dbxquery will be used as filter, so it shouldn't be returning events but the field that you want to use as filter. The syntax should be like this

host="10.62.140.64" NOT [|dbxquery...| table Field1 ]

This will get translated as this after subsearch has returned results

host="10.62.140.64" NOT (Field1="ValueFromdbxquery1" OR Field1="ValueFromdbxquery2"...)
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!