Knowledge Management

database conditional input

hugohctint
Loves-to-Learn Lots

I have an oracle database connection that I need to run a select and look for records and then check whether or not each one if does not exist needs to be included as a new event. I had set a dbconnect input but I do not thing it would accept any conditional command against an index or sourcetype.

Thanks in advance for your help

Tags (1)
0 Karma

hugohctint
Loves-to-Learn Lots

Hello Woodcock,
It think It is actually the other way. I need to find records on the database SELECT statement under a condition and then check if if they do not exist in the index as an event. Only if the new value does not exist in the index I need to "insert it" as a new event on the index.

0 Karma

woodcock
Esteemed Legend

Now we are talking; try this:

index=customer
| stats count by customer
| table customer
| rename customer AS dropme
| format "customer IN(" "" "" "," "" ")"
| rex field=search mode=sed "s/dropme=//g s/,\s*\)/)/"
| map search="|dbxquery ... \"SELECT * FROM Cust_NUM > \"100\" AND $search$\""
0 Karma

hugohctint
Loves-to-Learn Lots

sure, I give you an example (just seudo code):

something like... dbxquery < param> "SELECT * FROM Customer where Cust_NUM > "100" | search index=customer| if (customer) exits then "add the event into index" else skip

Is it more clear now?

0 Karma

hugohctint
Loves-to-Learn Lots

sure, I give you an example (just seudo code):

something like... dbxquery < param> "SELECT * FROM Customer where Cust_NUM > "100" | search index=customer| if (customer) exits then "add the event into index" else skip

Is it more clear now?

0 Karma

woodcock
Esteemed Legend

I do not get the "look for" and "check whether" parts. We need much more detail here.

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...