I have multiple inputs(3 INPUTS) in a dashboard, I run a sql in the panels. I want to execute a query if the other two values are null. Can you help me with the query.
|dbxquery connection="*" query="select * from usr where mID like 'id=$dn$%'". Other values $in_ID, ex_ID. I want to execute this query if values of $in_ID, ex_ID is null.
Hi @Raging_Rags ,
probably this isn't the answer you're waiting for: your approach isn't efficient because dbxquery in a panel is a very slow command.
dbxquery is a command (as dbxlookup) to extract data from a db and put them in an index (or in a lookup) with scheduled searches as less frequent as possible, then you can use the extracted data for your Splunk searches that are very efficient.
Ciao.
Giuseppe
Yeah, That's a good idea, but I'm working on a dynamic database, which at least 100K data get indexed in the table. So, I'm not indexing it in Splunk just connecting the DB to Splunk.
Hi @Raging_Rags ,
maybe I shouldn't say it but I would say that in your case maybe Splunk is not the optimal solution: If you have to work with a database, use another tool.
Access to DB tables is useful to trace a process or to enrich a search, it isn't another interface to DB!
Splunk and a DB has a completely different approach to data searching.
For this reason I suggested to periodically extract data from a DB putting them in an index or in a lookup (eventually in a KV Store that's like a DB).
Think if you can follow this approach: a daily update of all the table and periodically (e.g. every hour) extraction of the updates, in this way you'll have a near real time situation but much much more usable.
Ciao.
Giuseppe