Dashboards & Visualizations

cannot create a report or dashboard from a SQL query

sutanudas
Engager

Hello,
I installed and configured dbx app to get data directly using SQL query from an Oracle Database to get the size of the database and i get the size as a single value but once i save it as 'Saved Search' i CANONOT create a report or dashboard out of it

How can I create a report / dashboard our of a SQL query value from a saved search?

Pls advise - thanks again

ShaneNewman
Motivator

I only know how to do this in advanced XML.

First, you will have to schedule the saved search and make it visible to the app that you have created the report/dashboard in. Once you have it scheduled, make sure it runs once before you go to the dashboard.

In the dashboard XML file, add something to this effect in the appropriate location:

<module name="HiddenSavedSearch">
  <param name="savedSearch>your saved search name here</param>
  <param name="useHistory">true</param>

  The rest of your modules will go here

</module>

If you want the query to run as someone loads the page then it will be more like this:

<module name="SavedSearch" autoRun="True">
  <param name="savedSearch>your saved search name here</param>

  The rest of your modules will go here

</module>

Make sure that the saved search that you create looks like this:

| dbquery "select * FROM your_database.your_table" | any other stuff here...

It is very important that there is a pipe before dbquery or it will not work. Just FYI, I have had issues with putting "|" in macros and saved searches. It might be an issue with having the pipe in the saved searches. You may also not have the dbx modules needed shared with the proper app.

If none of these work for you, let me know.

0 Karma

somesoni2
Revered Legend

Could you be more specific on what is happening when you're including that saved search in your dashboard?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...