I am converting many dashboards from using dbquery to dbxquery. I have a few hundred of these queries to convert, with thousands if fields involved.
One of the problems is that dbxquery either returns fields in alphabetical order (unlike dbquery which returns them in schema order), or if you specify shortnames=false you can get them in schema order, but the field names include the order number and the data type!
I am thinking I have to use shortnames=false in order to get the schema order, and try to rename the fields back to their original names. The fields come out like "(001).FIELDA.VARCHAR2", "(002).FIELDB.NUMBER" etc.
I was hoping to make a macro that would rename these fields back to FIELDA, FIELDB etc. If I include all the different datatypes, I can do:
| rename *.VARCHAR2 as *, *.NUMBER as *, etc.
I can also have a long list of:
`| rename "(001).*" as *," "(002).*" as * etc`.
However, these matches don't work. If I remove the "." then they work, but I wind up with fields named .FIELDA, .FIELDB etc. (all starting with a dot). I also wonder if these field names have a new line character in them -- they always appear on different lines and maybe that's why the number and the dot together won't match.
My questions are: 1) can I do this with renames at all? 2) can I do this with more of a regex search? or 3) is there some other way to get dbxquery to return fields in the schema order using shortnames=true?
I have seen other postings complaining about this behavior. It's also a problem if your SQL query lists fields in a particular order -- again they get switched to alphabetical when made into Splunk fields.
Thanks, Rick
... View more
