Archive
Highlighted

Splunk DB Connect: Is it possible to specify a SQL Query by running an inner join query to use as the database input?

Path Finder

In the DB Connect app, when I try to add a Database Input, instead of selecting a Table Name I would like to Specify the SQL Query.
I want to run a very simple join query to use as the input. Is this possible? If so, what am I doing wrong:

select Documents.tmpname, DocumentStatistics.*
From DocumentStatistics
INNER JOIN Documents
On DocumentStatistics.image_id=Documents.image_id;

I am getting the following error when I try to do this (it works fine if I just select the table):

01-13-2015 11:53:46.206 +1100 ERROR AdminManagerExternal - Received malformed XML from external handler:\nFailed to validate: com.splunk.config.SplunkConfigurationException: Error validating dbmonTail for monitor=dbmon-tail://Database/New Data: [New Data] Invalid query " select Documents.tmpname, DocumentStatistics.*\r\r\n From DocumentStatistics\r\r\n INNER JOIN Documents\r\r\n On DocumentStatistics.image_id=Documents.image_id;" without proper {{ ... $rising_column$ > ?}} pattern! with query = ...
0 Karma
Highlighted

Re: Splunk DB Connect: Is it possible to specify a SQL Query by running an inner join query to use as the database input?

Builder

You should be able to do that, the only thing might preventing you is a duplicated column name. Can you see any errors inside dbx.log file?

0 Karma
Highlighted

Re: Splunk DB Connect: Is it possible to specify a SQL Query by running an inner join query to use as the database input?

Path Finder

Thanks musskopf, I have added the error logs to the question

0 Karma
Highlighted

Re: Splunk DB Connect: Is it possible to specify a SQL Query by running an inner join query to use as the database input?

Path Finder

The answer is that I forgot to append the following to my query:
{{WHERE $rising_column$ > ?}}

Now all working. Thanks Musskopf for setting me in the right direction.

View solution in original post

0 Karma
Highlighted

Re: Splunk DB Connect: Is it possible to specify a SQL Query by running an inner join query to use as the database input?

New Member

Thanks, have you had a problem with the date in your table? because i have a problen with that, the format is diferente when i import the data of my data bases within splunk.
regards.

0 Karma