All Apps and Add-ons

dbquery Syntax Error

harshavrath
Contributor

Hi,

I'm struggling with dbquery syntax, please anyone tell the correct syntax.

I have configured my oracle DB with Splunk DBX, I'm able to view tables of my DB but I'm unable to query them.

Any Help is Appreciated,

Thanks.

Tags (3)
0 Karma
1 Solution

aelliott
Motivator

Syntax
dbquery

sql-database: Name of a configured database listed in the database.conf file.

dbquery-sql:
The SELECT query string to execute.
Format options:
"databaseName"
db=databaseName
database=databaseName

| dbquery "mysql" "SELECT * FROM hosts WHERE active = 1" limit=25

http://docs.splunk.com/Documentation/DBX/1.1.3/DeployDBX/Commands

View solution in original post

aelliott
Motivator

Syntax
dbquery

sql-database: Name of a configured database listed in the database.conf file.

dbquery-sql:
The SELECT query string to execute.
Format options:
"databaseName"
db=databaseName
database=databaseName

| dbquery "mysql" "SELECT * FROM hosts WHERE active = 1" limit=25

http://docs.splunk.com/Documentation/DBX/1.1.3/DeployDBX/Commands

aelliott
Motivator

they don't match what's in the database?
If so you may want to have a separate post since we got the query running 🙂

harshavrath
Contributor

but the date column is not correct.

0 Karma

harshavrath
Contributor

Thanks its working now, because of semi-colon at the end of the stmt it was giving an error.

0 Karma

harshavrath
Contributor

hey I'm leaving now will post the error message tomorrow that i'm getting.

0 Karma

aelliott
Motivator

what error is it giving you?

harshavrath
Contributor

I tried the normal select stmt
Select * from Table_Name its not working

0 Karma

aelliott
Motivator

in the db query page you just put in your query, you select a database name and write your normal query.
So just the SELECT * FROM TABLE-NAME , or select top 1000 * from TABLE-NAME

harshavrath
Contributor

what's the difference in Querying from the Search page & DB Query Page..?

0 Karma

harshavrath
Contributor

| dbquery "DB___NAME" "SELECT * FROM TABLE-NAME" LIMIT=1000
this does not work in DB Query Page but works fine in the normal Search Page.

0 Karma

aelliott
Motivator

do you have an example of something that does not work?

0 Karma

harshavrath
Contributor

This syntax works fine from the search page of DBX but it does not work in DB Query.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...