Splunk Search

sql query to splunk query

deeptha1992
New Member

How I can Change this sql query to splunk query, I tried in different way but It is not giving proper result please help me

Select sys.name as 'CName', count(ucs.RID) [Update], sys.Workgr as 'Domain'
From Update_CS ucs
JOIN System sys on sys. RID = ucs. RID
JOIN UpdateIn ui on ucs.CID = ui.CID
Where ucs. RID IN(Select RID from FullCollection where Coll_ID = '1010') AND
UCS.CID IN(select TCID from SMS_CIR
where FCID = '100200') AND UCS.status in ('0','2')
GROUP BY sys.name, sys. Workgr
ORDER BY 'CName' ASC

Thanks in advance

Tags (2)
0 Karma

harish_l
New Member

Please try with below syntax to get the SQL query working in splunk:

| dbxquery connection= [fetchsize=] [maxrows=] [timeout=] [shortnames=] query= OR procedure= [params=]

For more information: Please see the splunk documentation.

https://docs.splunk.com/Documentation/DBX/3.1.4/DeployDBX/Commands

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@deeptha1992

Please check below link and let us know if you require any further assistance in SPL design.

https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/SQLtoSplunk

0 Karma

Azeemering
Builder

Try this:

| dbxquery query="Select sys.name as 'CName', count(ucs.RID) [Update], sys.Workgr as 'Domain'
 From Update_CS ucs
 JOIN System sys on sys. RID = ucs. RID
 JOIN UpdateIn ui on ucs.CID = ui.CID
 Where ucs. RID IN(Select RID from FullCollection where Coll_ID = '1010') AND
 UCS.CID IN(select TCID from SMS_CIR
 where FCID = '100200') AND UCS.status in ('0','2')
 GROUP BY sys.name, sys. Workgr
 ORDER BY 'CName' ASC" connection="<not_selected>" 
0 Karma

deeptha1992
New Member

Thanks.. But i need to convert this to SPL query. I have onboarded the table through splunk db connect. I need to create dashboard as like this query provided. want to know how to write a search query from this given sql query.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...