Hi,
Is there anyway for DB Connect (using dbquery) to create a summary index?
I would do this as a scheduled search, running your | dbquery
select statement, and prompt Splunk to summarize the results, just like any other saved search.
I would do this as a scheduled search, running your | dbquery
select statement, and prompt Splunk to summarize the results, just like any other saved search.