Getting Data In

Search query does not return any values

pratapa
Explorer

User complains that the following query is not returning any values in Splunk. 

dbquery wmsewprd  "select REC_TYPE, CODE_TYPE, CODE_DESC, SHORT_DESC, USER_ID from SYS_CODE_TYPE"

0 events

Time range picker : All time 

 

when he runs the same query at database end it is returning results.

Following is the query he is running on database.

select REC_TYPE, CODE_TYPE, CODE_DESC, SHORT_DESC, USER_ID from wmsew.SYS_CODE_TYPE;

 

Why it is not returning any results when we run in splunk.

 

 

 

Labels (1)
0 Karma

anilchaithu
Builder

@pratapa 

If the users are trying the SPL you shared here, then The syntax is not correct

Please try this

 

| dbxquery connection="connection_name" query="select REC_TYPE, CODE_TYPE, CODE_DESC, SHORT_DESC, USER_ID from SYS_CODE_TYPE"

 

 

Hope this helps

0 Karma

pratapa
Explorer

This worked.

dbquery wmsewprd  "select REC_TYPE, CODE_TYPE, CODE_DESC, SHORT_DESC, USER_ID from SYS_CODE_TYPE"

 

We created database connection under setting->External Databases and after that restarted splunk on the host.

When we tried the below query, it worked.

 

dbquery wmsewprd  "select REC_TYPE, CODE_TYPE, CODE_DESC, SHORT_DESC, USER_ID from SYS_CODE_TYPE"

 

This issue is resolved.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!