Splunk Search

Splunk DB Connect: Is it possible to specify a SQL Query by running an inner join query to use as the database input?

KindaWorking
Path Finder

In the DB Connect app, when I try to add a Database Input, instead of selecting a Table Name I would like to Specify the SQL Query.
I want to run a very simple join query to use as the input. Is this possible? If so, what am I doing wrong:

select Documents.tmpname, DocumentStatistics.*
From DocumentStatistics
INNER JOIN Documents
On DocumentStatistics.image_id=Documents.image_id;

I am getting the following error when I try to do this (it works fine if I just select the table):

01-13-2015 11:53:46.206 +1100 ERROR AdminManagerExternal - Received malformed XML from external handler:\nFailed to validate: com.splunk.config.SplunkConfigurationException: Error validating dbmonTail for monitor=dbmon-tail://Database/New Data: [New Data] Invalid query " select Documents.tmpname, DocumentStatistics.*\r\r\n From DocumentStatistics\r\r\n INNER JOIN Documents\r\r\n On DocumentStatistics.image_id=Documents.image_id;" without proper {{ ... $rising_column$ > ?}} pattern! with query = ...
0 Karma
1 Solution

KindaWorking
Path Finder

The answer is that I forgot to append the following to my query:
{{WHERE $rising_column$ > ?}}

Now all working. Thanks Musskopf for setting me in the right direction.

View solution in original post

0 Karma

KindaWorking
Path Finder

The answer is that I forgot to append the following to my query:
{{WHERE $rising_column$ > ?}}

Now all working. Thanks Musskopf for setting me in the right direction.

0 Karma

enriquemr
New Member

Thanks, have you had a problem with the date in your table? because i have a problen with that, the format is diferente when i import the data of my data bases within splunk.
regards.

0 Karma

KindaWorking
Path Finder

Thanks musskopf, I have added the error logs to the question

0 Karma

musskopf
Builder

You should be able to do that, the only thing might preventing you is a duplicated column name. Can you see any errors inside dbx.log file?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...