Hi guys,
Is it possible to use the DB Connect lookup like inputlookup? I do not need to join the lookup data with other events and the data should always be up to date, as is always the case in the external database. This is why I don't want to use the input, because it is not possible to update the indexed data, right? I hope someone can follow me.
In my case I have to illustrate data from an external database on a Splunk dashboard. The external data is triggered from another application and the view should always be up to date. Old records are useless and annoying in my query.
Thank you so much!
cheers
sorry i read this but it didnt answer my question...
Is it possible to use the db connect lookup like inputlookup? I do not need to join the lookup data with other events and the data should always be up to date, as is always the case in the external database
Yes, take a look again at the dbxquery command again and focus on the examples. There's no inputlookup command, it's called dbxquery instead. For instance, your query could be:
| dbxquery query="SELECT * FROM tableFoo" connection="FooBar"
| do something else
That's assuming you are running DB Connect 2. If that's not your case you can always use dbquery instead:
http://docs.splunk.com/Documentation/DBX/1.0.11/DeployDBX/Commands
Let me know if that helps.
Hi @nikkc, please don't forget to mark it as answered if you are happy with the response so that others can benefit from it.
Otherwise it'll look as unanswered forever and ever and ever...