Reporting

Splunk DB Connect: How to get a report of the latest event (device status) for each device in my database?

rameshlpatel
Communicator

Hi,

I have configured DB Connect to get latest data from database to get latest device status like Online/Offline. I have more then 12k devices and same data coming from the database each minute. At the time of creating the SPLUNK report, I have to find the latest event coming from each device to get latest device status.

Please could you help me how I can achieve this?

0 Karma

sanjay_shrestha
Contributor

You can create a scheduled saved search to create a lookup file

| dbquery "YOURDATABASE" "select * from  deviceinfo"|outputlookup device_status.csv

Then use it in your query

index=your_index .....|lookup device_status.csv device_id output device_status
0 Karma

rameshlpatel
Communicator

thanks Sanjay for your answer, however I am storing data in index as key-value pair and not using csv.

0 Karma

sanjay_shrestha
Contributor

you can try like this:

index=device_index... | join device_id [search index=yourdevicestatus_index|stats first(device_status)  by device_id]
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...