Hello,
I just want to know if this scenario can be achieved in splunk with DB connect Lookups . I am getting data from the Database through DBconnect inputs and I want to correlate my database data with a CSV file data, but I need to happen this within the DB connect input SQL query execution.
Is it possible to do this or any other alternative?
Thanks
Yes, the dbconnect app supports sql query directly via lookups.
You can also use the dbxquery search command combined with the outputlookup command to generate lookups on the fly or by scheduling the search to run at certain times.
Please refer to the dbconnect documentation on how to do so.
Yes, the dbconnect app supports sql query directly via lookups.
You can also use the dbxquery search command combined with the outputlookup command to generate lookups on the fly or by scheduling the search to run at certain times.
Please refer to the dbconnect documentation on how to do so.
Thanks for your reply. But what I am looking for is I already have a CSV file with me in Splunk and I wanted it to be correlated with the database input before the resultant data gets indexed into splunk to skip the unwanted data and index only the matched field. Any advise?
Yes you can do that with dbxquery command, lookup and collect commands
So you upload your CSV as lookup and do a search like this:
| dbxquery ... | lookup csvFileName.csv ... | collect index=indexName