Archive

DB Connect 1: Is it possible to get a new field using dbquery that does not exist in an index?

Contributor

Hi

I want to know if it's possible to get a new field from dbquery that does not exist in an index:

index=A 
[|inputlookup file.csv | table field_ip]
| join type=outer fieldA [dbquery ..."select......" |fields + fieldA |rename fieldA as fieldB]
|table fieldB

i tried this, but was not successful. fieldB doesn't exist in index=A, but i need it. How can i do it?

thx

0 Karma

Splunk Employee
Splunk Employee

The right way to do this is a dblookup.

0 Karma

Contributor

but the dblookup can return just the first matching line in my database

0 Karma