Archive
Highlighted

How to join log file data from Splunk and data from a table in MySQL.

Communicator

Hi All,

I am trying to join a log file(sourceType) which is present in Splunk with data from a table in MySQL through Splunk-MySQL Connector.
I found some few examples online on the type of queries, like these ones:
1. | mysqlquery spec=MyDB query="show tables;"
2. | mysqlquery spec=MyDb query="SELECT * FROM MyTable;"
3. sourcetype=access* [ mysqlquery spec=MyDb query="SELECT customerid WHERE purchaseditem=rockingchair" ]

But i am getting a error while using all these. Its says "(1049, u"Unknown database 'splunk'")"

My log file is called "Radius log" and table in MySQL is called "Custdet" in db called "MyDB".
The log file and table have a common field called "IP
add".

Could anyone help me out with building the query.

Thanks!!

0 Karma
Highlighted

Re: How to join log file data from Splunk and data from a table in MySQL.

Splunk Employee
Splunk Employee

Have you run through the setup in the MySQL connector app? It has a browser you can use to verify your connection details

0 Karma
Highlighted

Re: How to join log file data from Splunk and data from a table in MySQL.

Communicator

Sorry for the stupid question.

I had to change the Schema name in the MySQL Connector. Its default value was Splunk, hence the error.

Thanks!!

0 Karma
Highlighted

Re: How to join log file data from Splunk and data from a table in MySQL.

Communicator

Sorry for the stupid question.

I had to change the Schema name in the MySQL Connector. Its default value was Splunk, hence the error.

Thanks!!

View solution in original post

0 Karma