Dashboards & Visualizations

Why does the dbxquery break when put into the dashboard?

DerBastler
New Member

Hey there,

I stumbled over an issue with a dbxquery. While it works perfectly fine outside of a dashboard, it breaks when I put it into the dashboard.

I am basically putting together a query like this:

| table myips
| eval myquery = "SELECT yadda yadda WHERE data_ip in (".myips.");"
| map search="| dbxquery connection=SomeDatabase query=$myquery$"

And it works perfectly fine, however once I put it into a dashboard it starts to break.
First, the dashboard is looking for input. If I create a dummy inputfield with the token myquery, it will give out an error:
"[map]: At least a query or stored procedure parameter is required."

I also tried to put it together and mix the double quotes with the single quotes but that doesn't work either.

Do you have any other idea on how to do that? Just using dbxquery without the map command is not working either as the db connection has to occur in the middle of the splunk query.

Tags (3)
0 Karma
1 Solution

niketn
Legend

@DerBastler, please try the following. You need to escape the $ sign in token with $$ in the dashboard:

 <yourCurrentSearch>
 | table myips
 | map search="| dbxquery connection=SomeDatabase query=\"SELECT yadda yadda WHERE data_ip in (\"$$myips$$\")\""

Please try out and confirm!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

DerBastler
New Member

Cool, yeah, double $ work well, thanks a lot! 🙂

0 Karma

niketn
Legend

@DerBastler, please try the following. You need to escape the $ sign in token with $$ in the dashboard:

 <yourCurrentSearch>
 | table myips
 | map search="| dbxquery connection=SomeDatabase query=\"SELECT yadda yadda WHERE data_ip in (\"$$myips$$\")\""

Please try out and confirm!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

@DerBastler, have you tried the following in dashboard?

<yourCurrentSearch>
| table myips
| map search="| dbxquery connection=SomeDatabase query=\"SELECT yadda yadda WHERE data_ip in (\"$myips$\")\""
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

DerBastler
New Member

Keeping the the (\".myips.\") intact breaks with an error:

expected something between '(' and '.'.
so likely escaping the field breaks it.

also exchanging this to (\"$myips$\")\"
as described in your example results in the old problem that the dashboard is waiting for some input for myips.

0 Karma

niketn
Legend

Can you try escaping $ with $$ i.e.

(\"$$myips$$\")\"

One more thing you can try is using token with string escaping i.e.

($myips|s$)\"

I will try to mimic with similar map command use case as I current do not have DB Connect to test dbxquery.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...