Splunk DB Connect: Can the lookup table for defining extra fields in a datamodel be a dblookup?

[kundeng]

It seems that the lookup table for defining extra fields in datamodel can not be a dblookup (database lookup)? Can someone confirm this is the case and not a bug?

The dblookup works fine in standalone search, but I am not able to make it to work in datamodel editor.

[jcoates_splunk]

I think that's correct... if you can take a bit of delay in recognizing the new schema, you can use the dblookup to regularly generate a new Splunk lookup.

[sanjay_shrestha]

Could you pls elaborate more what do you mean by "you can use the dblookup to regularly generate a new Splunk lookup"?

[jcoates_splunk]

a saved search that looks something like this:
dblookup mydb "select * from mytable" | outputlookup mylookup
then you use mylookup in your searches

[sanjay_shrestha]

Did you mean |dbquery instead of |dblookup.
I was using |dbquery but the lookup file kept growing and its huge. To avoid this we also wanted to implement dblookup in datamodel.

[jcoates_splunk]

d'oh -- yes, that is what i meant... can you use a SQL limit to keep the size of your query down?

[sanjay_shrestha]

no as lookup can be done to any record for last one year.

[jcoates_splunk]

maybe it would work better to dbquery blah | dedup eventid | collect mysummary?

[sanjay_shrestha]

We thought about that but not preferable to create new summary index in this case.