How I can Change this sql query to splunk query, I tried in different way but It is not giving proper result please help me
Select sys.name as 'CName', count(ucs.RID) [Update], sys.Workgr as 'Domain'
From Update_CS ucs
JOIN System sys on sys. RID = ucs. RID
JOIN UpdateIn ui on ucs.CID = ui.CID
Where ucs. RID IN(Select RID from FullCollection where Coll_ID = '1010') AND
UCS.CID IN(select TCID from SMS_CIR
where FCID = '100200') AND UCS.status in ('0','2')
GROUP BY sys.name, sys. Workgr
ORDER BY 'CName' ASC
Thanks in advance
Please try with below syntax to get the SQL query working in splunk:
| dbxquery connection= [fetchsize=] [maxrows=] [timeout=] [shortnames=] query= OR procedure= [params=]
For more information: Please see the splunk documentation.
https://docs.splunk.com/Documentation/DBX/3.1.4/DeployDBX/Commands
@deeptha1992
Please check below link and let us know if you require any further assistance in SPL design.
https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/SQLtoSplunk
Try this:
| dbxquery query="Select sys.name as 'CName', count(ucs.RID) [Update], sys.Workgr as 'Domain'
From Update_CS ucs
JOIN System sys on sys. RID = ucs. RID
JOIN UpdateIn ui on ucs.CID = ui.CID
Where ucs. RID IN(Select RID from FullCollection where Coll_ID = '1010') AND
UCS.CID IN(select TCID from SMS_CIR
where FCID = '100200') AND UCS.status in ('0','2')
GROUP BY sys.name, sys. Workgr
ORDER BY 'CName' ASC" connection="<not_selected>"
Thanks.. But i need to convert this to SPL query. I have onboarded the table through splunk db connect. I need to create dashboard as like this query provided. want to know how to write a search query from this given sql query.