Splunk Search

Splunk DB Connect SQL query with variables

efn
Engager

Hi, I am trying to make a Data Lab Input for Splunk DB Connect using the followng query:

declare @cntr_value_1 numeric(20,3)
declare @cntr_value_2 numeric(20,3)
declare @delay_time varchar(12)
set @delay_time = right(convert(varchar(30),dateadd(second,1,0),121),12)
select @cntr_value_1 = cntr_value
from [master].[dbo].[sysperfinfo]
where counter_name = 'Page reads/sec'
waitfor delay @delay_time
select @cntr_value_2 = cntr_value
from [master].[dbo].[sysperfinfo]
where counter_name = 'Page reads/sec'
SELECT convert(numeric(20,1),round((@cntr_value_2-@cntr_value_1)/1,3)) AS DB_VALUE

The query executes fine, but when I want to save the Input, the following message appears:
There was an error processing your request. It has been logged (ID 13fb315b3ef49ffd).

I wonder if the problem are the variables.

amahoski
Explorer

DBX3 currently does not support using variables within a DB input statement. You can use parameters for things such as rising columns.

http://docs.splunk.com/Documentation/DBX/3.1.3/DeployDBX/Createandmanagedatabaseinputs

Basically, you would likely need to create a view if it is possible for the query you are attempting.

0 Karma

dgelo
Explorer

Hi,

Why it does not support? How can i use db lookup query with variables? Need install oldest db connect (v1) or maybe have workaround?

0 Karma
Get Updates on the Splunk Community!

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...