How to join log file data from Splunk and data from a table in MySQL.

[alenseb]

Hi All,

I am trying to join a log file(sourceType) which is present in Splunk with data from a table in MySQL through Splunk-MySQL Connector.
I found some few examples online on the type of queries, like these ones:
1. | mysqlquery spec=MyDB query="show tables;"
2. | mysqlquery spec=MyDb query="SELECT * FROM MyTable;"
3. sourcetype=access_* [ mysqlquery spec=MyDb query="SELECT customer_id WHERE purchased_item=rocking_chair" ]

But i am getting a error while using all these. Its says "(1049, u"Unknown database 'splunk'")"

My log file is called "Radius log" and table in MySQL is called "Cust_det" in db called "MyDB".
The log file and table have a common field called "IP_add".

Could anyone help me out with building the query.

Thanks!!

[alenseb · Accepted solution]

Sorry for the stupid question.

I had to change the Schema name in the MySQL Connector. Its default value was Splunk, hence the error.

Thanks!!

[alenseb]

Sorry for the stupid question.

I had to change the Schema name in the MySQL Connector. Its default value was Splunk, hence the error.

Thanks!!

[dart]

Have you run through the setup in the MySQL connector app? It has a browser you can use to verify your connection details