Archive

Splunk DB Connect 1: Can you use the chart command with dbquery like you can with an index search?

jamesbrennan
Explorer

Hi

I've managed to create charts happily from an index to a flat file with inputs from a dashboard;

index=indxdata
|where field ="$inpfield$" 
|table ..
|chart count by "Range" | rename count as "Number"

But can this also be made when the data source is from dbquery? I cannot manage the same with similar below?

dbquery "select field1, field2 FROM table1 WHERE field ="$inpfield$"... "
| chart count by "field1" 
1 Solution

yannK
Splunk Employee
Splunk Employee

yes you can apply regular splunk stats or chart or timechart commands to the results of a dbquery.
Just double check that your fields name and case are correct before.

View solution in original post

yannK
Splunk Employee
Splunk Employee

yes you can apply regular splunk stats or chart or timechart commands to the results of a dbquery.
Just double check that your fields name and case are correct before.

View solution in original post

jamesbrennan
Explorer

Actually, it was CASE issue, thanks - although the base dbquery is lower case, the chart syntax requires UPPER.

This worked
dbquery "select field1, field2 FROM table1 WHERE field ="$inpfield$"... " | chart count by "FIELD1"

jamesbrennan
Explorer

Hi, that's what I was hoping, but I cant seem to pipe the results through to the chart? The first query returns results.
But when I apply the chart clause it does not return anything?

| dbquery "Oracle" "select username, common from all_users" | chart count by "common"

Would you have any syntax examples at all? Many Thanks

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!