Hi All,
I kindly request your help to get fields extracted from database column. I'm working on splunk db-connect app. Can anyone please provide me sample sql query to extract subfields from status field?
For e.g. I would need something like msg=login failed, host and ip fields to be extracted from below unique database records.
Sample Database output with unique records from splunk db-connect app:
Date User Input Status
xxx abc 123 login failed...
host=xyz |
ip=0.0.0.0 |
yyy xyz 456 login successful
zzz pqr 789 host=xyz |
ip=0.0.0.0 |
Appreciate your help!!
You should contact a DBA for the database in question for help writing a SQL query for that database.
extract command in Splunk may help..
Sample query:
|makeresults | eval _raw=" Status
login failed...\nhost=xyz |\nip=0.0.0.0
login successful
host=xyz |\n ip=0.0.0.0 |" | multikv forceheader=1 | eval Status=split(Status,"\n") | eval temp=_raw,_raw=Status | extract | rename temp as _raw