I'm attempting to update a MySQL table using dboutput. I have an output stanza defined to simplify my searches. If I use the following search command where 'myupdate' is my output stanza name:
...| dboutput myUpdate IPAddress NetAddress ComputerName Manufacturer Model
I get this error message:
"Error in 'dboutput' command: command="dboutput", Missing mandatory option: type (Usage: dboutput ([dboutput-stanza] | type=<insert|update> database=<database> table=<table> [notFound=<ignore|fail|insert>] (<field> [as column]|*)+) )"
It would seem I am not specifying dboutput-stanza correctly. Can anyone set me straight? Or is this a bug in dboutput?
The dboutput command changed in DBX 1.1 to not allow output stanzas. The complete syntax is now documented in http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Commands#dboutput.
The dboutput command changed in DBX 1.1 to not allow output stanzas. The complete syntax is now documented in http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Commands#dboutput.
you need to list as the fields like below. I believe it works like field1(name in splunk results) AS field1(column name in db)
| dboutput type=insert database=mydb table=mytable key=somekey field1 AS field1 field2 AS field2
Thanks, cramasta, but I think I wasn't clear about my problem. The dboutput usage string says it takes either an output-stanza name or a set of arguments (type, database, etc.). I'm trying to do the former and it's not being accepted.