Splunk Search

sql query to splunk query

deeptha1992
New Member

How I can Change this sql query to splunk query, I tried in different way but It is not giving proper result please help me

Select sys.name as 'CName', count(ucs.RID) [Update], sys.Workgr as 'Domain'
From Update_CS ucs
JOIN System sys on sys. RID = ucs. RID
JOIN UpdateIn ui on ucs.CID = ui.CID
Where ucs. RID IN(Select RID from FullCollection where Coll_ID = '1010') AND
UCS.CID IN(select TCID from SMS_CIR
where FCID = '100200') AND UCS.status in ('0','2')
GROUP BY sys.name, sys. Workgr
ORDER BY 'CName' ASC

Thanks in advance

Tags (2)
0 Karma

harish_l
New Member

Please try with below syntax to get the SQL query working in splunk:

| dbxquery connection= [fetchsize=] [maxrows=] [timeout=] [shortnames=] query= OR procedure= [params=]

For more information: Please see the splunk documentation.

https://docs.splunk.com/Documentation/DBX/3.1.4/DeployDBX/Commands

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@deeptha1992

Please check below link and let us know if you require any further assistance in SPL design.

https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/SQLtoSplunk

0 Karma

Azeemering
Builder

Try this:

| dbxquery query="Select sys.name as 'CName', count(ucs.RID) [Update], sys.Workgr as 'Domain'
 From Update_CS ucs
 JOIN System sys on sys. RID = ucs. RID
 JOIN UpdateIn ui on ucs.CID = ui.CID
 Where ucs. RID IN(Select RID from FullCollection where Coll_ID = '1010') AND
 UCS.CID IN(select TCID from SMS_CIR
 where FCID = '100200') AND UCS.status in ('0','2')
 GROUP BY sys.name, sys. Workgr
 ORDER BY 'CName' ASC" connection="<not_selected>" 
0 Karma

deeptha1992
New Member

Thanks.. But i need to convert this to SPL query. I have onboarded the table through splunk db connect. I need to create dashboard as like this query provided. want to know how to write a search query from this given sql query.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...