Archive

Splunk DB Connect 1: Can I run dbquery with a variable?

Explorer

I need to schedule a report which runs dbquery, but I need that report to run with a variable in the query e.g.

| eval myVar=stuff
| dbquery source "select * from table where timestamp >= '".myVar."'"

Or something like that, but of course this doesn't work since dbquery must be the first command of a search.

Has anyone come across this before or found a way around it?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

You can try like this (using map command)

| gentimes start=-1 | eval myVar=stuff | map search="| dbquery source \"select * from tble where timestamp >= $myVar$ \" "

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

You can try like this (using map command)

| gentimes start=-1 | eval myVar=stuff | map search="| dbquery source \"select * from tble where timestamp >= $myVar$ \" "

View solution in original post

0 Karma

Explorer

Worked a treat. Thanks. I can't figure out what gentimes is used for though.

0 Karma