All Apps and Add-ons

how to convert dbquery search to dbxquery search

hartfoml
Motivator

I have several hundred dbquery searches that I need to make work with the new DB Connect Version and convert to dbxquery. The select statements seam to work ok with the new connecter but the output is very different.

With the old connector I get an output field of NAME
With the new connector I get an output field of (002) ORGANIZATION.NAME.VARCHAR

is there a way to limit the output on the new connector to only the column name and not show the column number (002) and the table ORGANIZATION and the data type VARCHAR in the output field

The old syntax form of | dbquery "connectorname" "select"
to the new syntax of | dbxquery connection="connectorname" query="select"

I think I can deal with this OK with a search and replace.
The output field name changes will mean a whole other set of complexity to the conversion.

1 Solution

somesoni2
Revered Legend

You need to include following parameter with your dbxquery command.

shortnames

Syntax: shortnames=<bool>
Description: By default, the returned fields will be in the form <TABLE>.<COLUMN>.<DATATYPE>. Setting the shortnames argument to true will return fields called <COLUMN>.
Default: shortnames=false

View solution in original post

somesoni2
Revered Legend

You need to include following parameter with your dbxquery command.

shortnames

Syntax: shortnames=<bool>
Description: By default, the returned fields will be in the form <TABLE>.<COLUMN>.<DATATYPE>. Setting the shortnames argument to true will return fields called <COLUMN>.
Default: shortnames=false

hartfoml
Motivator

you are a lifesaver. Don't know how i missed this in the documentation. Thanks so much.

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...