Splunk Search

DBConnect - Best way to join three tables

UMoritz
New Member

Hi

I've three tables with the following structure in the same Microsoft SQL database:

ApplicationEvent - Columns: id,application_id,message

Application - Columns: id,name, applicationtype_id

ApplicationType - Columns: id, name

I want to get the following row in SPLUNK:
ApplicationEvent.message, Application.name, ApplicationType.name

What's the best way to achieve this?

I've tried automatic lookups, lookup command and join without success.

Thanks in advance

Tags (1)
0 Karma

UMoritz
New Member

Hi all

Thanks for your answers. I'll check this.

0 Karma

jpass
Contributor

Why not create a 'view' on the database server that joins these tables. Then your dbconnect query is a simple select * from view_name

0 Karma

UMoritz
New Member

Hi jpass

thanks to you, too.

0 Karma

linu1988
Champion

Yes best think to do, it's waste of resource to do that in splunk..

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Have you considered joining them in SQL before indexing / loading into Splunk?

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...