Hi @PickleRick Thanks for your help 1. Like I mentioned, the DB is on a different connection, if it's possible it will take a while until the DB team work on this. So, as a workaround I will need...
See more...
Hi @PickleRick Thanks for your help 1. Like I mentioned, the DB is on a different connection, if it's possible it will take a while until the DB team work on this. So, as a workaround I will need to do this at least to get the data now. 2. Yes 50k is for the join 3. Thanks. Let me look into _internal. The alerting that I am looking for is not only for a case where certain data hits a Splunk's internal threshold, but I also need it for other cases (non-Splunk's internal threshold), for example, if my scheduled report contains empty data or if data hits a certain threshold (max/min). 4. Sorry, perhaps my explanation in the example is not clear enough because it's difficult to lay it out without a real example in SPL. Both tables (host table and contact table) in the example have been in Splunk and can be accessible via a DBX query. Like I mentioned before, the problem is that we cannot join in the DB; both are on different connections; the table host is in Connection A, and the table contact is in Connection B. | dbxquery connection ="connectionA" query="select ip, host from table host"
| dbxquery connection ="connectionB" query="select ip, contact from table contact" I did not search remotely on every search, but instead I ran this command for each subnet to find the number of rows. For example 10.0.1.0/16 => 20k rows and so on. | dbxquery connection ="connectionB" query="select ip, contact from table contact where ip::inet<'10.0.0.0/16'"
| dbxquery connection ="connectionB" query="select ip, contact from table contact where ip::inet<'10.1.0.0/16'"
| dbxquery connection ="connectionB" query="select ip, contact from table contact where ip::inet<'10.2.0.0/16'"
| dbxquery connection ="connectionB" query="select ip, contact from table contact where ip::inet<'10.3.0.0/16'" Once I figure the number of rows, then I group them until it hits right below 50k, so I am saving subsearches. If one subnet above 50k, I will need to split them. I hope this makes sense. Note that this is only workaround. join max=0 type=left ip
[| dbxquery connection ="connectionB" query="select ip, contact from table contact where ip::inet<'10.0.0.0/16' OR ip::inet<'10.1.0.0/16'"
|eval source="group1"
]