Splunk Search

Continue on dbxquery Failure

ohbuckeyeio
Path Finder

I have a search that performs a basic dbxquery connection and SQL search.  If the database table were to be dropped or there were any other errors encountered during the search, I would like the rest of the SPL to keep chugging along.

Is there a creative way to continue past the dbxquery error?

This is a simple example looking up an Oracle DB name:

 

| makeresults
| eval connection_name="<my db connection>"
| map search="| dbxquery connection=$connection_name$ query=\"select * from global_nameWRONG;\""
| eval test="didn't get here"
| table GLOBAL_NAME,test

 

Labels (1)
0 Karma
Get Updates on the Splunk Community!

This dashboard view is deprecated and will be removed in future versions of Splunk ...

After upgrading to Splunk Enterprise 9.0 I do get the following message from several Dashboard.This dashboard ...

How to ingest a selection of JSON fields

I have a dump.json file that collects events in JSON format:<BR ...

Why getting timeout error while adding data to the Splunk cloud index from REST API?

Hello Team,<BR /><BR />I am getting timeout error while adding data to Splunk cloud index from REST API. I am ...