Splunk Search

How to Join a SourceType in Splunk With data from MySQL

alenseb
Communicator

Hi All,

I am trying to join data from a sourcetype in Splunk with data from MySQL.
I am using Splunk-MySQL Connector, but i am not able to get to the correct syntax.

My sourceType is called "Radius" and the table in MySQL is called "Cust_det"
Now the common field between them is IP_Address, therefore i can have a join to get all the rows in the sourcetype(Radius) having a similar IP_Address in the table.

Could anyone help me out with the syntax for the query.

Thanks!!

0 Karma
1 Solution

dart
Splunk Employee
Splunk Employee

Sounds like a great use case for a MySQL lookup

View solution in original post

0 Karma

dart
Splunk Employee
Splunk Employee

Sounds like a great use case for a MySQL lookup

0 Karma
Get Updates on the Splunk Community!

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...