How to extract fields from database column using sql query on splunk db connect application.

[firefox95]

Hi All,

I kindly request your help to get fields extracted from database column. I'm working on splunk db-connect app. Can anyone please provide me sample sql query to extract subfields from status field?

For e.g. I would need something like msg=login failed, host and ip fields to be extracted from below unique database records. 

Sample Database output with unique records from splunk db-connect app:

 Date   User  Input        Status

  xxx     abc      123        login failed...

                                            host=xyz |

                                            ip=0.0.0.0 |

 yyy      xyz      456       login successful

 zzz     pqr       789       host=xyz |

                                           ip=0.0.0.0 |

Appreciate your help!!

[richgalloway]

You should contact a DBA for the database in question for help writing a SQL query for that database.

[saravanan90]

extract command in Splunk may help..

Sample query:

|makeresults | eval _raw=" Status
login failed...\nhost=xyz |\nip=0.0.0.0
login successful
host=xyz |\n ip=0.0.0.0 |" | multikv forceheader=1 | eval Status=split(Status,"\n") | eval temp=_raw,_raw=Status | extract | rename temp as _raw