All Apps and Add-ons

Fetching search strings from database.

anuj1630
New Member

Hi,

I am having a RDBMS connected to Splunk via DB Connect. Inside that RDMS there is a table which stores queries that I have to excecute on splunk. For example: one row is like this
Id Search_String
1 index="XYZ" sourcetype=ABC | convert ctime(_time) as Time timeformat="%U" | stats dc(source) by Time

So my requirement is, I have to fetch this search string from my DB (which I am able todo using DBConnect) and automatically execute on Splunk (which I don't know how to do) to generate report.

Is it possible to do? If yes, then how to do it. Since I am beginner on Splunk, please guide me on this.

0 Karma

niketn
Legend

@anuj1630, This seems to be a duplicate of https://answers.splunk.com/answers/561370/execution-of-search-strings-stored-in-an-external.html

Is your intent to execute only one query at a time? If so,

Step 1) You can feed your dbxquery to populate a table with two columns Id and Search_String (PS: In order to mock the data from Database, I have used makeresults, you can use your current query instead).

Step 2) You can create table <drilldown> to create queryString with the query fetched from the Database Search using $row.Search_String$ token.

Step 3) Finally use the $queryString$ token in the other search that you want to execute. PS: I have included a Time input control with `tokTime, to ensure that the second search run for required duration of time.

<form>
  <label>Dummy Dashboard</label>
  <fieldset submitButton="false">
    <input type="time" token="tokTime">
      <label>Select Time Range</label>
      <default>
        <earliest>-30d@d</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
| eval Id=1
| eval Search_String="index=\"_internal\" sourcetype=\"splunkd\" | convert ctime(_time) as Time timeformat=\"%U\" | stats dc(component) by Time"
| append [| makeresults
| eval Id=2
| eval Search_String="index=\"_internal\" sourcetype=\"splunkd\" | convert ctime(_time) as Time timeformat=\"%U\" | stats dc(group) by Time"]
| fields - _time</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <set token="queryString">$row.Search_String$</set>
        </drilldown>
      </table>
    </panel>
  </row>
  <row depends="$queryString$">
    <panel>
      <table>
        <search>
          <query>
          $queryString$
        </query>
        <earliest>$tokTime.earliest$</earliest>
        <latest>$tokTime.latest$</latest>
        </search>
      </table>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...