About stevenahl

stevenahl · ‎05-27-2015

Still no joy.

stevenahl · ‎05-27-2015

| dbquery Server1 "SELECT value1, value2 FROM db1.table" | join type=left value2 [| dbquery Server2 "SELECT value2, value3 FROM db2.table"] | table value1, value2, value3 Still does the same thing...

stevenahl · ‎05-27-2015

| dbquery Server1 "SELECT value1, value2 FROM db1.table" | join type=left value2 [| dbquery Server2 "SELECT value3 FROM db2.table"] | table value1, value2, value3 I have two tables, in two databases on two different servers that I need to join. They have a single common value (we'll say value2 here). When running the actual code, "value3" is the same for every row. I'm not sure where I have this wrong, but I don't understand how the splunk join works between two servers like this. Thoughts?

stevenahl · ‎05-19-2015

That did it. Why would dedup make that work, though? I don't see the connection...

stevenahl · ‎05-18-2015

host=* | map search="| dbquery Database \"SELECT * FROM Table WHERE Column='$host$'\"" | table * I'm fairly new to Splunk (only been playing with it since last Thursday) and I'm still trying to figure things out. What I'm trying to achieve with script is get all hosts, look them up in the database and then output any data resulting from the match. It seems to work but only for one host where literally hundreds to thousands should be present. What am I doing wrong?

Posts	5
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎05-18-2015

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Splunk DB Connect 1: How to join SQL queries from ...

Using all info from search in subsearch?

Re: Splunk DB Connect 1: How to join SQL queries f...

Re: Splunk DB Connect 1: How to join SQL queries f...

Splunk DB Connect 1: How to join SQL queries from ...

Re: Using all info from search in subsearch?

Using all info from search in subsearch?