Reporting

Splunk DB Connect: How to get a report of the latest event (device status) for each device in my database?

rameshlpatel
Communicator

Hi,

I have configured DB Connect to get latest data from database to get latest device status like Online/Offline. I have more then 12k devices and same data coming from the database each minute. At the time of creating the SPLUNK report, I have to find the latest event coming from each device to get latest device status.

Please could you help me how I can achieve this?

0 Karma

sanjay_shrestha
Contributor

You can create a scheduled saved search to create a lookup file

| dbquery "YOURDATABASE" "select * from  deviceinfo"|outputlookup device_status.csv

Then use it in your query

index=your_index .....|lookup device_status.csv device_id output device_status
0 Karma

rameshlpatel
Communicator

thanks Sanjay for your answer, however I am storing data in index as key-value pair and not using csv.

0 Karma

sanjay_shrestha
Contributor

you can try like this:

index=device_index... | join device_id [search index=yourdevicestatus_index|stats first(device_status)  by device_id]
0 Karma
Get Updates on the Splunk Community!

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...