Monitoring Splunk

DBX - Missing placeholder for condition!

preis4
New Member

Hi,

I'm trying to configure a monitor (tail) and i've set the following query:

select to_char(b.data_reg,'rrrr-mm-dd hh24:mi:ss') DATA_HORA, a.dominio,      a.cliente,a.entidade, b.valor NUM_PED_PROGRESS from carateristicas_metricas a, metricas b where     b.id>42813607 and a.id_metrica=b.id_metrica and a.metrica='NUM_PED_PROGRESS' order by 1

From the manual,

"Use a specific SQL query to pull the data in: select the Configure
advanced Database lookup settings checkbox, then define a SQL query
and use the $input_field$ as a placeholder for each input field."

I've set the Rising Column as "b.id"

but when I try to run the monitor I'm getting the following error:

dbx3358:ERROR:TailDatabaseMonitor - Configuration Error: Invalid query specified! Missing placeholder for condition!

What argument should I change to obtain the correct result ?

0 Karma

briansutherland
Explorer

This works {{AND $rising_column$ > ?}} with MSSQL
The ? references the rising_column field you set outside the query in "Tail Input settings".
After the first parse where the entire output of the query is pulled into Splunk.
The tail option kicks in and only pulls in new data based on the rising column.

0 Karma

lukejadamec
Super Champion

Have you tried

where a.id_metrica=b.id_metrica and a.metrica='NUM_PED_PROGRESS'
{{AND $rising_column$ > 42813607}}

Note: $rising_column$ is the placeholder and will be automatically replaced with whatever you enter into the Rising Column field.

0 Karma

mbenwell
Communicator

Hey,
I was just looking at the same issue.

Theres a hint just below the custom sql query input box

"You can specify the SQL query that is executed against the database yourself. For information on how to specify such a query, see Splunk DB Connect documentation. Example:
SELECT * FROM my_table {{WHERE $rising_column$ > ?}}"

Try replacing "b.id>42813607" in your query with $rising_column$ > ?

Now Im not sure about the importance of the curly braces though

Cheers
Mat

florianhachenbe
Engager

the curly braces are needed!

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...