Archive

Splunk DB Connect 1: Where do I put the token name in a dbquery search string for a chart drilldown?

Explorer

Hi,

I'm using Splunk 6.2.3 and DB Connect 1. I have connected to an Oracle database. I have applied an input drilldown on a chart, but it is showing "error in dbquery command". this command must be in first search". Please help me and share any document for this.

Thanks in advance,
A.kavya.alt text

0 Karma
1 Solution

Motivator

try like:

 | dbquery Oracle limit=1000 "SELECT DISTINCTn EFZ_VIEW_DWT_CBS_GL_BAL.COMPANY_CODE as Subsidiary,n EFZ_VIEW_DWT_CBS_ ...."|eval your_field_name="$field1$"|where your_filter_field=your_field_name|....

View solution in original post

Motivator

try like:

 | dbquery Oracle limit=1000 "SELECT DISTINCTn EFZ_VIEW_DWT_CBS_GL_BAL.COMPANY_CODE as Subsidiary,n EFZ_VIEW_DWT_CBS_ ...."|eval your_field_name="$field1$"|where your_filter_field=your_field_name|....

View solution in original post

Explorer

Yes. Thank you verymuch. I have already got it. I have tried like that same process

Motivator

i happy for you.

0 Karma

Contributor

dbquery command must exist as the first word in the query. you can use token fields inside the query or later part.

0 Karma