Splunk Search

Why doesn't dbquery as a subsearch produce expected results?

NigelCooke
Explorer

I'm having problems with getting a dbquery command to filter the results of a search.

When I run this search :

| dbquery PUMA_T3_ADHOC_REPORTING "select distinct AlertKey from (select AlertKey, update_time from alarm_collector order by update_time asc) where rownum = 1"
| eval PointCode = ALERTKEY
| table PointCode

I get a single result, a field called PointCode with a value of RTOX9891.

When I run this search :

index=ams sourcetype=ams TitleCode=GS TitleIndex=0120 EventType=TSAM*
[search dbquery PUMA_T3_ADHOC_REPORTING "select distinct AlertKey from (select AlertKey, update_time from alarm_collector order by update_time asc) where rownum = 1"
| eval PointCode = ALERTKEY
| table PointCode]

I get no resuts, even though when I run this search :

index=ams sourcetype=ams TitleCode=GS TitleIndex=0120 EventType=TSAM* PointCode=RTOX9891

I get two results.

Should not the second search produce the same results as the third search? The subsearch should filter the outer result set to those having a value for PointCode of RTOX9891.

Any idea why the second search doesn't produce results?

0 Karma
1 Solution

acharlieh
Influencer

Your subsearch should be just [dbquery... ] doing [search dbquery ...] is actually performing a splunk search which isn't quite what you want.

View solution in original post

acharlieh
Influencer

Your subsearch should be just [dbquery... ] doing [search dbquery ...] is actually performing a splunk search which isn't quite what you want.

zarembski
Engager

It worked for me as expected.
Thanks!

0 Karma

NigelCooke
Explorer

Can you add your comment as an answer so that I can accept your answer because it was spot on.

acharlieh
Influencer

Your subsearch should be [dbquery ... ] not [search dbquery ... ]

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...