Splunk Search

dboutput bug updating MySQL

richgalloway
SplunkTrust
SplunkTrust

I'm using DB Connect to send search results to MySQL. My search command is:

... | dboutput type=update notFound=insert database=mydb table=mytable fields=IPAddress AS ip, NetAddress AS mac, ComputerName AS device_name,
 Manufacturer AS manufacturer, Model AS model_name key=ip,mac *

This produces the error message "No value specified for parameter 1". Turning on debug logging I see the following query is generated:

UPDATE mytable SET `AS`=$AS$, ip=$ip$, NetAddress=$NetAddress$, ComputerName=$ComputerName$, Manufacturer=$Manufacturer$, Model=$Model$, mac=$mac$, IPAddress=$IPAddress$ WHERE ip = $ip$

Notice the 'AS' column was inserted. Where did it come from and how do I get rid of it?

Also, my key argument specified two fields, but only one appears in the query. Is that another bug or something I did wrong?

---
If this reply helps you, Karma would be appreciated.
0 Karma

Dan
Splunk Employee
Splunk Employee

You can't currently have multiple key values for the update to occur on. This is one of the things we might add when we make dboutput GA.

0 Karma

cramasta
Builder

trying to get my hands on the mysql connector, I dont think it has this limitation.

0 Karma

cramasta
Builder

FYI, finding out that trying to use type=update will fail when Splunk results are more than 100 rows. Seems that type=insert is able to run batches of 100 but type=update doesn't know how to run batches and the max that will work is whatever the setting is in the java.conf file for batch size

Here is the error you would see ( i updated the batch size to 105 and tried exporting 108 rows, exporting 104 rows would work)

command="dboutput", Unexpected error while performing dboutput: java.lang.ArrayIndexOutOfBoundsException: 105

0 Karma

cramasta
Builder

I would be interested in knowing if you can actually provide two key values for the update to occur on.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...