Please explain in more detail what you want to achieve by "passing values out of the original query". ... View more

The error is very well hidden in the log file: java.io.FileNotFoundException: C:\Program Files\Splunk\var\lib\splunk\persistentstorage\dbx\global\state.xml (Access is denied) . It Seems like the DB Connect process is not able to access file it needs to write to. Please check the permissions of your Splunk installation directory. ... View more

The error indicates that DB Connect has troubles decrypting some passwords stored in your configured databases (database.conf). The easiest way to repair this, is to edit the config and replace the encrypted passwords with the original (cleartext) ones. DB Connect will automatically encrypt them again, once the database is loaded. ... View more

Correct. Alternatively you can place the SQLite file into $SPLUNK_HOME/var/dbx (you might need to create this directory) and name it as database_name.sqlitedb , then you can use "database_name" instead of the fully qualified path. ... View more

The dbquery command doesn't directly allow you to join data from multiple databases, but you can use the Splunk search language to combine results from multiple queries that can come from different databases: | dbquery dbA "SELECT * FROM some_table" | join some_id [ dbquery dbB "SELECT * FROM another_table" ] In the example above, the results of both queries would be joined by the field/column "some_id". Another example would be to use the append command to form a union of 2 query results: | dbquery dbA "SELECT * FROM some_table" | append [ dbquery dbB "SELECT * FROM another_table" ] ... View more

See http://splunk-base.splunk.com/answer_link/76048/ ... View more

The dbquery command is not meant to do any kind of filtering. It simply emits the results of the SQL query. There is no clean approach to filtering results for the selected search timerange in a generic way as a SQL query might emit no, 1 or multiple viable candidates for an event timestamp field. That being said, you can use SPL (the Splunk search language) to filter the results in the search pipeline. The simplest approach is to use the where command to: | dbquery mydb "SELECT timestamp_column, other_column1, other_column2 FROM mytable" | where timestamp_column>relative_time(now(),"-7d") In this example, the results emitted by dbquery would be reduced to those, that match the condition in the where command and will only output results where the value of timestamp_column is within the last 7 days. A little more sophisticated approach is to additionally use the addinfo command. This adds some meta information about the search to the search results. This allows to actually honor the timerange seleted in the timerange picker. Here's little search macro that should ease the usage: [apply_timerange(1)] args = timefield definition = addinfo | where $timefield$>=info_min_time AND (info_max_time="+Infinity" OR $timefield$<=info_max_time) | fields - info_min_time info_max_time info_search_time info_sid iseval = 0 You can add this stanza to macros.conf or add it via Splunk Manager (Advanced Search -> Search Macros). The usage is fairly simple: | dbquery mydb "SELECT timestamp_column, other_column1, other_column2 FROM mytable" | `apply_timerange(timestamp_column)` ... View more

You shouldn't use ODBC for connecting to an Oracle database. Select "Oracle" from the list of available database types instead. ... View more

Have you set up line-breaking rules in props.conf for you custom sourcetypes? The last section on this page might help with that: http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Configuredatabasemonitoring ... View more

You can add the interval to the [default] stanza in inputs.conf, this will affect scripted inputs as well, though. [default] interval = 60s ... View more

You should see related errors in the debug log. You can find them by executing the saved search "Recent DB Connect errors" in the DB Connect app. Could you please post them here? ... View more

There was a change how the interval value is interpreted in 1.0.6. Numbers are now treated as seconds (before they have been interpreted as milliseconds). See the release notes. You can also use relative time-expressions (eg. 1m for one minute). The interval setting is not cached anywhere but is only read when the Java Bridge is restarted or reloaded. When you edit properties of a database input in the config file you typically have to restart Splunk. Database inputs are subject to Splunk's typical configuration layering. To view the actual settings in effect you can use btool: $ splunk cmd btool inputs list dbmon --debug Additionally you should be able to see all you configured database inputs and their schedule type when you take a look at the "Java Bridge Server Status" view in the Settings navigation menu in the app. Alternatively you can get the same status information in the console: $ splunk cmd python $SPLUNK_HOME/etc/apps/dbx/bin/status.py ... View more

The error message means that DB Connect stops executing your database input after it has been executed once. This is default behavior for the "Dump" input method if you don't provide a schedule or an interval. Since you're seeing the error message, your input has already successfully been executed once and you should be able to see indexed data - if there have been results. You can adjust the settings for the input and configure it to run on a regular basis by providing an interval (in seconds or a relative time expression) or a cron schedule. ... View more

Just to clarify: The database stanza in launcher/local/database.conf is not a cache. It's there because it has been created in the context of the launcher app. This happens when you navigate from Launcher to manager instead of navigating there from the DB Connect app. The behavior for other configs in Splunk like inputs or props is similar. ... View more

Database lookups (and actually all scripted lookups) cannot be used with the inputlookup command. You can still get similar results by using the dbquery command, though. One thing I noticed with your query is that you didn't use the input field in your query, which is necessary, though. Something like this is necessary: SELECT c.chan_id, c.inst_id, i.inst_name from TempTable.chan c, TempTable.inst i WHERE c.inst_id = i.inst_id AND c.chan_id = $chan_id$ ORDER BY c.inst_id The repacement token $chan_id$ is replaced with the actual lookup value when the lookup is executed. Alternatively you could create a view for your query and create a simple lookup for this view, which does not require input fields. ... View more

Well, the error message means that the server doesn't recognize the given service name. Maybe try it with the "not-fully-qualified" one? ... View more

Please use the ojdbc6.jar if possible. Here's a good explaination on the difference between SID and Service Name: http://stackoverflow.com/a/43901 An Oracle client is not required for DB Connect. ... View more

You might want to try the database monitor again with the latest version. There was a potential problem with the postgres JDBC driver that is now being taken care of. ... View more

There have been a few changes to the advanced database lookup functionality in DB Connect 1.0.7 and it should probably work now. ... View more

This should be fixed in the latest release (1.0.7). ... View more