sql query to splunk query

[deeptha1992]

How I can Change this sql query to splunk query, I tried in different way but It is not giving proper result please help me

Select sys.name as 'CName', count(ucs.RID) [Update], sys.Workgr as 'Domain'
From Update_CS ucs
JOIN System sys on sys. RID = ucs. RID
JOIN UpdateIn ui on ucs.CID = ui.CID
Where ucs. RID IN(Select RID from FullCollection where Coll_ID = '1010') AND
UCS.CID IN(select TCID from SMS_CIR
where FCID = '100200') AND UCS.status in ('0','2')
GROUP BY sys.name, sys. Workgr
ORDER BY 'CName' ASC

Thanks in advance

[harish_l]

Please try with below syntax to get the SQL query working in splunk:

| dbxquery connection= [fetchsize=] [maxrows=] [timeout=] [shortnames=] query= OR procedure= [params=]

For more information: Please see the splunk documentation.

https://docs.splunk.com/Documentation/DBX/3.1.4/DeployDBX/Commands

[kamlesh_vaghela]

@deeptha1992

Please check below link and let us know if you require any further assistance in SPL design.

https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/SQLtoSplunk

[Azeemering]

Try this:

| dbxquery query="Select sys.name as 'CName', count(ucs.RID) [Update], sys.Workgr as 'Domain'
 From Update_CS ucs
 JOIN System sys on sys. RID = ucs. RID
 JOIN UpdateIn ui on ucs.CID = ui.CID
 Where ucs. RID IN(Select RID from FullCollection where Coll_ID = '1010') AND
 UCS.CID IN(select TCID from SMS_CIR
 where FCID = '100200') AND UCS.status in ('0','2')
 GROUP BY sys.name, sys. Workgr
 ORDER BY 'CName' ASC" connection="<not_selected>" 

[deeptha1992]

Thanks.. But i need to convert this to SPL query. I have onboarded the table through splunk db connect. I need to create dashboard as like this query provided. want to know how to write a search query from this given sql query.