Splunk Search

sql query to splunk query

deeptha1992
New Member

How I can Change this sql query to splunk query, I tried in different way but It is not giving proper result please help me

Select sys.name as 'CName', count(ucs.RID) [Update], sys.Workgr as 'Domain'
From Update_CS ucs
JOIN System sys on sys. RID = ucs. RID
JOIN UpdateIn ui on ucs.CID = ui.CID
Where ucs. RID IN(Select RID from FullCollection where Coll_ID = '1010') AND
UCS.CID IN(select TCID from SMS_CIR
where FCID = '100200') AND UCS.status in ('0','2')
GROUP BY sys.name, sys. Workgr
ORDER BY 'CName' ASC

Thanks in advance

Tags (2)
0 Karma

harish_l
New Member

Please try with below syntax to get the SQL query working in splunk:

| dbxquery connection= [fetchsize=] [maxrows=] [timeout=] [shortnames=] query= OR procedure= [params=]

For more information: Please see the splunk documentation.

https://docs.splunk.com/Documentation/DBX/3.1.4/DeployDBX/Commands

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@deeptha1992

Please check below link and let us know if you require any further assistance in SPL design.

https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/SQLtoSplunk

0 Karma

Azeemering
Builder

Try this:

| dbxquery query="Select sys.name as 'CName', count(ucs.RID) [Update], sys.Workgr as 'Domain'
 From Update_CS ucs
 JOIN System sys on sys. RID = ucs. RID
 JOIN UpdateIn ui on ucs.CID = ui.CID
 Where ucs. RID IN(Select RID from FullCollection where Coll_ID = '1010') AND
 UCS.CID IN(select TCID from SMS_CIR
 where FCID = '100200') AND UCS.status in ('0','2')
 GROUP BY sys.name, sys. Workgr
 ORDER BY 'CName' ASC" connection="<not_selected>" 
0 Karma

deeptha1992
New Member

Thanks.. But i need to convert this to SPL query. I have onboarded the table through splunk db connect. I need to create dashboard as like this query provided. want to know how to write a search query from this given sql query.

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...