Splunk Search

joining result of a query with another db query

anoopambli
Communicator

I have two queries,

1) index = coreops sourcetype=sitescope_monitorstat UpTime | rex field=_raw "days=\s(?\d+)" | where UpTime>1000 | table remotehost,UpTime | dedup remotehost | sort -UpTime

2) |dbquery OPSCONFIGAPP limit=1000 "select hostname, tier_level_str,classification from opsconfig.ac_servers_for_fsc"

The first query gives me a result of server names and last reboot time like below,
scssum1 1357
lbos655 1187
adal480 1186

The second query is basically asset info of servers and gives result as below,

servername tier level Classification


lbos655 Linux Server Support - Gold Production

servername field is common in both the searches, i want to merge result of both the searches and get an end result like below,

lbos655 1187 Linux Server Support - Gold Production

How can i achieve this?

Tags (1)
0 Karma

musskopf
Builder

Hello anoopambli,

You'll need to use a DB Lookup, which works the same way as a file lookup, the difference is that it uses the SQL a source of data. Have a look on the DB Connect documentation how to do that: http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Setupadatabaselookuptable

I believe you'll be able to do everything using the GUI, no need to edit files by hand. Another thing to remember is that lookups are case-sensitive.

Hope I pointed you to the right direction.

Cheers

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...