Can we use DBconnect lookup for correlation of lookup file data with DB input data before indexing?

[arrangineni]

Hello,

I just want to know if this scenario can be achieved in splunk with DB connect Lookups . I am getting data from the Database through DBconnect inputs and I want to correlate my database data with a CSV file data, but I need to happen this within the DB connect input SQL query execution.

Is it possible to do this or any other alternative?

Thanks

[jkat54 · Accepted solution]

Yes, the dbconnect app supports sql query directly via lookups.

You can also use the dbxquery search command combined with the outputlookup command to generate lookups on the fly or by scheduling the search to run at certain times.

Please refer to the dbconnect documentation on how to do so.

[arrangineni]

Thanks for your reply. But what I am looking for is I already have a CSV file with me in Splunk and I wanted it to be correlated with the database input before the resultant data gets indexed into splunk to skip the unwanted data and index only the matched field. Any advise?

[jkat54]

Yes you can do that with dbxquery command, lookup and collect commands

So you upload your CSV as lookup and do a search like this:

| dbxquery ... | lookup csvFileName.csv ... | collect index=indexName