Dashboards & Visualizations

Import data from SQL view with DBConnect

Path Finder

Hi there,

I am try to import data from a SQL Server. Because the tables do not contain all the fiels i want to see i have created a view on the SQL server with some left joins.
I would like to index the data from that SQL view with the Splunk DBConnect app but I receive an error that "Incident" is an invalid Object Name.

My Select code:

SELECT [Incident #]
,[Opened Group:]
,[Open Date & Time]
,[Close Date & Time]
,[Incident Type]
,[Due Date & Time:]
,[First Call Resolution:]
,[Closed Group:]
,[Contact Type]
,[Group Name]
,[Client ID]
,[Login ID Closed By]
,[Asset/Tag #]
,[Department Name]
,[Login ID Opened By]
,[Impact ID:]
,[Urgency ID:]
,[Status ID:]
,[Subject ID]
WHERE [Incident #] > 10000_

Is it even possible to data input a view from a SQL server or what method should i use?

Thank you in advance!

0 Karma

Splunk Employee
Splunk Employee

Assuming you are putting your SQL Statement in the DB Connect, Data Input, view, you need to put the WHERE clause in {{}} brackets, and use the DB Connects passed/substituted variables instead of putting the actual fieldnames\/values, like what you have above.

Excerpt from documentation link:Splunk DB Connect Documentation

To specify a custom query, place the where clause in curly braces {{...}}.

The literal $rising_column$ will be replaced with the name specified in the rising column setting.

The literal ? will be substituted with the checkpoint value.
Example: SELECT * FROM my_table {{WHERE $rising_column$ > ?}}

0 Karma

Path Finder

Sorry, I forgot to mention that I changed the SQL statement to include the WHERE statement but Splunk doesn't recognize the SQL view, only SQL tables..

0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...