Splunk Search

Multiple inputs in dashboard

Raging_Rags
Engager

I have multiple inputs(3 INPUTS) in a dashboard, I run a sql in the panels. I want to execute a query if the other two values are null. Can you help me with the query.

|dbxquery connection="*" query="select * from usr where mID like 'id=$dn$%'". Other values $in_ID, ex_ID. I want to execute this query if values of $in_ID, ex_ID is null.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Raging_Rags ,

probably this isn't the answer you're waiting for: your approach isn't efficient because dbxquery in a panel is a very slow command.

dbxquery is a command (as dbxlookup) to extract data from a db and put them in an index (or in a lookup) with scheduled searches as less frequent as possible, then you can use the extracted data for your Splunk searches that are very efficient.

Ciao.

Giuseppe

0 Karma

Raging_Rags
Engager

Yeah, That's a good idea, but  I'm working on a dynamic database, which at least 100K data get indexed in the table. So, I'm not indexing it in Splunk just connecting the DB to Splunk.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Raging_Rags ,

maybe I shouldn't say it but I would say that in your case maybe Splunk is not the optimal solution: If you have to work with a database, use another tool.

Access to DB tables is useful to trace a process or to enrich a search, it isn't another interface to DB!

Splunk and a DB has a completely different approach to data searching.

For this reason I suggested to periodically extract data from a DB putting them in an index or in a lookup (eventually in a KV Store that's like a DB).

Think if you can follow this approach: a daily update of all the table and periodically (e.g. every hour) extraction of the updates, in this way you'll have a near real time situation but much much more usable.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...