Knowledge Management

database conditional input

hugohctint
Loves-to-Learn Lots

I have an oracle database connection that I need to run a select and look for records and then check whether or not each one if does not exist needs to be included as a new event. I had set a dbconnect input but I do not thing it would accept any conditional command against an index or sourcetype.

Thanks in advance for your help

Tags (1)
0 Karma

hugohctint
Loves-to-Learn Lots

Hello Woodcock,
It think It is actually the other way. I need to find records on the database SELECT statement under a condition and then check if if they do not exist in the index as an event. Only if the new value does not exist in the index I need to "insert it" as a new event on the index.

0 Karma

woodcock
Esteemed Legend

Now we are talking; try this:

index=customer
| stats count by customer
| table customer
| rename customer AS dropme
| format "customer IN(" "" "" "," "" ")"
| rex field=search mode=sed "s/dropme=//g s/,\s*\)/)/"
| map search="|dbxquery ... \"SELECT * FROM Cust_NUM > \"100\" AND $search$\""
0 Karma

hugohctint
Loves-to-Learn Lots

sure, I give you an example (just seudo code):

something like... dbxquery < param> "SELECT * FROM Customer where Cust_NUM > "100" | search index=customer| if (customer) exits then "add the event into index" else skip

Is it more clear now?

0 Karma

hugohctint
Loves-to-Learn Lots

sure, I give you an example (just seudo code):

something like... dbxquery < param> "SELECT * FROM Customer where Cust_NUM > "100" | search index=customer| if (customer) exits then "add the event into index" else skip

Is it more clear now?

0 Karma

woodcock
Esteemed Legend

I do not get the "look for" and "check whether" parts. We need much more detail here.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...