About alexsmirnoff

alexsmirnoff · ‎03-15-2018

Hi I need a way to generate PDF (same format as when generated on the UI) using the API provided by SPLUNK. There are hundreds of reports that must be generated, each week the date range changes and the reports must be generated to a folder. I have found no examples of how to generate a report in PDF format using the C# API. The rest API refers to dashboards, but this is a saved report for an application. Is this possible?

alexsmirnoff · ‎02-15-2018

The only thing close to what I ased is the last example on this link. It did not work when I pumped in a basic sql query. I tried this (except with a real view): | dbquery MyDatabase [ eval query= "SELECT DISTINCT TOP 10 * FROM V_MyView "] This did not work at all 😞 All I got was SPLUNK errors. Can please direct me to something that is a simple complete working example. Anthing that can use a eval and joins 2 strings. I saw this page ages ago, tried thier example and they didnt work. My real query has averages, counts and calculations, so it cannot be a two set query. There are millions of rows of data in my query (big data). The second part of the question is very simply. I should not be given a URL. What are the variable names for Earliest and Latest (based on the image). Are they $job.earliestTime$ and $job.latestTime$ if not... what are they? I would have thought this would be the first example on the user guide on how to use dbquery.

alexsmirnoff · ‎02-15-2018

Hello Can someone please tell me how to add a date range to dbquery. I wish the time range of the image (text boxes in the edit Search, Reports, and alerts) as shown in the image. I assume this is $job.earliestTime$ and $job.latestTime$ What I want is something like | dbquery MyDatabase "SELECT DISTINCT TOP 10 * FROM V_MyView MyDate BETWEEN " + $job.earliestTime$ + " and " + $job.latestTime$ Basically, return everything in a date range as my view is too big and I only need the range that is selected. But I keep getting the error command="dbquery", A database error occurred: Invalid SQL statement or JDBC escape, terminating ''' not found. I also tried things like | dbquery MyDatabase "SELECT DISTINCT TOP 10 * FROM V_MyView MyDate BETWEEN " . $job.earliestTime$ . " and " . $job.latestTime$ dbquery must be the first command so I cannot use anything like eval 😞 I'm sure I cant be the first person to have this issue. Please help.

alexsmirnoff · ‎02-14-2018

In short I am trying to do the exact same thing as this query | dbquery MyDatabase "SELECT DISTINCT TOP 10 * FROM V_MyView" This works 100%, but I want a lookup, something like | dbxlookup lookup="MyLookup" But this line works 0% 😞

alexsmirnoff · ‎02-14-2018

Already read this in the past.. Couldnt get it to work. sourcetype=GTS_Sessions | dbxlookup lookup="GTS_Product_Lookup" | stats sum(product_price) as "spend" by uid What is "GTS_Session" how is it defined?

alexsmirnoff · ‎02-14-2018

DB Connect

alexsmirnoff · ‎02-14-2018

The below works, but is not using lookup. I need it to run as a lookup | dbquery MyDatabase "SELECT DISTINCT TOP 10 * FROM V_MyView"

alexsmirnoff · ‎02-14-2018

This a Database Lookup. Not a csv.

alexsmirnoff · ‎02-14-2018

That did not work 😞 I type (replacing it with my lookup name) "|inputlookup MyView" into the test box called "Search" and this return 0 results. The "Search" text box is under Searches,reports, and alerts->new The result should be over 2 million. As stated earlier, there is no index in the select statement so no prefix. My database view is V_MyView and my lookup name for it is MvView. Do I need to do V_MyView instead? Can this be done without the index?

alexsmirnoff · ‎02-13-2018

How do you search only using a lookup so that I can return a report with the contence of the lookup... I do not want any index in the search. I have created a database lookup using a view (Lets call it MyView). Lets call my Lookup which points the the view MyLookup In the search result, I want to have SELECT * FROM MyView This does not require any index join or anything else. Can this be done and how? I tried souce=MyLookup and I tried index=MyLookup Nothing returns result. Please help.

Posts	10
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎02-13-2018

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Download PDF from search c# API

How can I add a date range to dbquery based on sea...

How to search using ONLY lookup

Download PDF from search c# API

Re: How can I add a date range to dbquery based on...

How can I add a date range to dbquery based on sea...

Re: How to search using ONLY lookup

Re: How to search using ONLY lookup

Re: How to search using ONLY lookup

Re: How to search using ONLY lookup

Re: How to search using ONLY lookup

Re: How to search using ONLY lookup

How to search using ONLY lookup