How to Join a SourceType in Splunk With data from MySQL

[alenseb]

Hi All,

I am trying to join data from a sourcetype in Splunk with data from MySQL.
I am using Splunk-MySQL Connector, but i am not able to get to the correct syntax.

My sourceType is called "Radius" and the table in MySQL is called "Cust_det"
Now the common field between them is IP_Address, therefore i can have a join to get all the rows in the sourcetype(Radius) having a similar IP_Address in the table.

Could anyone help me out with the syntax for the query.

Thanks!!

[dart · Accepted solution]

Sounds like a great use case for a MySQL lookup