Splunk Search

DB Connect 1: Is it possible to get a new field using dbquery that does not exist in an index?

sfatnass
Contributor

Hi

I want to know if it's possible to get a new field from dbquery that does not exist in an index:

index=A 
[|inputlookup file.csv | table field_ip]
| join type=outer fieldA [dbquery ..."select......" |fields + fieldA |rename fieldA as fieldB]
|table fieldB

i tried this, but was not successful. fieldB doesn't exist in index=A, but i need it. How can i do it?

thx

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

The right way to do this is a dblookup.

0 Karma

sfatnass
Contributor

but the dblookup can return just the first matching line in my database

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...