Reporting

Splunk DB Connect: How to get a report of the latest event (device status) for each device in my database?

rameshlpatel
Communicator

Hi,

I have configured DB Connect to get latest data from database to get latest device status like Online/Offline. I have more then 12k devices and same data coming from the database each minute. At the time of creating the SPLUNK report, I have to find the latest event coming from each device to get latest device status.

Please could you help me how I can achieve this?

0 Karma

sanjay_shrestha
Contributor

You can create a scheduled saved search to create a lookup file

| dbquery "YOURDATABASE" "select * from  deviceinfo"|outputlookup device_status.csv

Then use it in your query

index=your_index .....|lookup device_status.csv device_id output device_status
0 Karma

rameshlpatel
Communicator

thanks Sanjay for your answer, however I am storing data in index as key-value pair and not using csv.

0 Karma

sanjay_shrestha
Contributor

you can try like this:

index=device_index... | join device_id [search index=yourdevicestatus_index|stats first(device_status)  by device_id]
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...