splunk db connect

[achille83]

Hi,

I have a Splunk DB Connect v.2.4.1 upon client platform and I must implement a SQL query to import specific data from Client database to Splunk.

In the subquery previous the final select, I have this construct "Sum(abs(table_column_name)) AS .... " but the launched query give me an error as result.

Is a problem related to App in general, or to App version, or to SQL construct? in alternative, would be better to realize the SQL construct once imported the data in Splunk?

Thanks in advance.

AC 

[achille83]

Hi, 

I report the query in short format and I hope being enough:

"SELECT DISTINCT
r.*,
r.total
FROM
(SELECT
d.*,
SUM(ABS(d.IMP_MOV_EURO)) AS total
FROM
(SELECT
f.*,
f.IMP_MOV_EURO
FROM
(subquery expression) f
) d
) r "

At the top, in the final select distinct, I must report the column "total" that has been calculated in the previous query with the expression "SUM(ABS(d.IMP_MOV_EURO)) AS total".  SUM(ABS(d.IMP_MOV_EURO)) AS total doesn't work; I also tried with "SUM(CAST(ABS(d.IMP_MOV_EURO)) AS total)" without fortune.

[richgalloway]

What is the error?

If you can, please share the full query, masking sensitive parts.