Dashboards & Visualizations

Import data from SQL view with DBConnect

CerielTjuh
Path Finder

Hi there,

I am try to import data from a SQL Server. Because the tables do not contain all the fiels i want to see i have created a view on the SQL server with some left joins.
I would like to index the data from that SQL view with the Splunk DBConnect app but I receive an error that "Incident" is an invalid Object Name.

My Select code:

SELECT [Incident #]
,[Opened Group:]
,[State:]
,[Open Date & Time]
,[Close Date & Time]
,[Incident Type]
,[Due Date & Time:]
,[First Call Resolution:]
,[Closed Group:]
,[Contact Type]
,[Group Name]
,[Client ID]
,[Login ID Closed By]
,[Asset/Tag #]
,[Department Name]
,[Login ID Opened By]
,[Impact ID:]
,[Urgency ID:]
,[Status ID:]
,[Subject ID]
FROM [SDE].[_SMDBA
].[Incident]
WHERE [Incident #] > 10000_

Is it even possible to data input a view from a SQL server or what method should i use?

Thank you in advance!

0 Karma

shogan_splunk
Splunk Employee
Splunk Employee

Assuming you are putting your SQL Statement in the DB Connect, Data Input, view, you need to put the WHERE clause in {{}} brackets, and use the DB Connects passed/substituted variables instead of putting the actual fieldnames\/values, like what you have above.

Excerpt from documentation link:Splunk DB Connect Documentation

To specify a custom query, place the where clause in curly braces {{...}}.

The literal $rising_column$ will be replaced with the name specified in the rising column setting.

The literal ? will be substituted with the checkpoint value.
Example: SELECT * FROM my_table {{WHERE $rising_column$ > ?}}

0 Karma

CerielTjuh
Path Finder

Sorry, I forgot to mention that I changed the SQL statement to include the WHERE statement but Splunk doesn't recognize the SQL view, only SQL tables..

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...