With DBConnect v2, it looks like dbquery was replaced with dbxquery, however, the syntax doesn't appear to be documented. Looking at the python command code, I see it needs a connection and query argument, however, when these are supplied, the search just runs. This same SQL query works fine from the SQL query page and with DBConnect v1.
| dbxquery connection=CONNECTION query=QUERY
I tried no quotes, single quotes, and double quotes around the SQL query
I have found dbxquery does work. The downside is you have to replace spaces and special characters with the hex equivalent (See below)...
| dbxquery connection=XYZ query="SELECT%20Location,%20NodeID,%20Caption,%20Description,%20IP_Address%20FROM%20MyTable%20WHERE%20(Caption%20LIKE%20%27%-P0%%27)%20OR%20(Caption%20LIKE%20%27%A0%%27)"
"dbxquery" command is working in DBconnect ver-2 not in DB-connect =< ver-1.1.7 that I have tested.
The command syntax is bit awkward any space need to reconverted hex-code:
Working command:
| dbxquery query="SELECT%20*%20FROM%20customers" connection="Northwind_products"
I have found dbxquery does work. The downside is you have to replace spaces and special characters with the hex equivalent (See below)...
| dbxquery connection=XYZ query="SELECT%20Location,%20NodeID,%20Caption,%20Description,%20IP_Address%20FROM%20MyTable%20WHERE%20(Caption%20LIKE%20%27%-P0%%27)%20OR%20(Caption%20LIKE%20%27%A0%%27)"
you%20can%27t%20read%20url%20encoded%20strings%3F!%3F
It has been corrected. Spaces work fine.
this is going to be corrected in a future release. In the meantime, you can use urlencode tools or sites to get it right (note that it's got to replace space with %20, not -).
@jcoates_splunk any news on when DB Connect v2 queries won't require to be URL encoded any longer?
Any ideas when this will be corrected?
I confirm this works, major bummer on this since Splunk has no easy urlencode function, only urldecode.
I plan to use dbxquery for a long dynamic SQL query but I'll have to wait for this to be fixed because I have PullDown modules sending variables and encoding the query partially in URL Encoded format wont suffice.