About tmuth_splunk

tmuth_splunk · ‎04-09-2021

I believe commands that start with a pipe in the UI have an implied search | ... in front of the command. Try changing your search parameter from: search=" | dbxquery query=\"SELECT count(*) FROM db.table\" to search="search | dbxquery query=\"SELECT count(*) FROM db.table\"

tmuth_splunk · ‎06-04-2020

If you're interested, I wrote a dedup example for this exact scenario: https://github.com/tmuth/splunking-oracle/blob/master/Duplicates/delete-duplicates.spl to allow you to delete the duplicates. Keep in mind that Splunk doesn't really delete the duplicates, it just marks them as deleted, so you wouldn't save space on disk. The short retention period suggested by Rich solves that. This technique would allow you to search without using the dedup command.

tmuth_splunk · ‎04-03-2019

Take a look at the examples in this doc: https://docs.splunk.com/Documentation/DBX/3.1.4/DeployDBX/Commands Your procedure needs at least an out parameter (as the first parameter) of type SYS_REFCURSOR

tmuth_splunk · ‎03-15-2019

DDL is not formally supported in DBX 2.x or 3.x. Depending on the database (Oracle, SQL Server, ...) you can encapsulate your DDL in a stored procedure and call that stored procedure from dbxquery

tmuth_splunk · ‎01-18-2019

You are aware that DBX 1.x reached End of Life in like 2016, correct?

tmuth_splunk · ‎09-25-2018

Where does srp_date get set? Is it a database trigger or in some other app? Can events come into the db out of order? You can change your order by to be the same as the order by in the row_number() analytic function if that does in fact give a definitive sort order: ORDER BY srp_date,srp_ordernum,srp_seqno_in_hand_off,srp_hof_seqno However, I don't see that would materially change the behavior in terms of losing events.

tmuth_splunk · ‎09-19-2018

The only way I know of would be to use >= instead of > so you won't miss events. The problem now is that you will have duplicate events. If you have some columns that can identify a unique record, you can just use "dedup" in SPL. I've thought about this problem...a lot.

tmuth_splunk · ‎09-14-2018

row_number() is defined at runtime of the query. If you only do inserts, never updates or deletes, then you can just use srp_date as your rising column.

tmuth_splunk · ‎09-04-2018

The "mysql" part of the exception leads to me believe that you might be choosing the wrong type of DB when creating the connection.

tmuth_splunk · ‎09-04-2018

Probably. The thing about the ODA is the odd setup of the shared storage between the nodes. I can't remember exactly how it's exposed to the OS, but it's possible the internal storage is not really supported. You can't use ACFS or cloudfs for Splunk. So, can the internal disks be configured so at least one of the nodes can see them as one of the supported file systems listed here: http://docs.splunk.com/Documentation/Splunk/7.1.2/Installation/Systemrequirements#Supported_file_systems ?

tmuth_splunk · ‎06-06-2018

Are you sure the HWF running DBX isn't overloaded on CPU or RAM? I would start there.

tmuth_splunk · ‎04-23-2018

You might need to send the body as a file. I did this for DBX using the following (bash function): function create_input { for i in `seq 1 ${RETRY_MAX}`; do response=$(curl -k -u ${SPLUNK_USERNAME}:${SPLUNK_PASS} -H "Content-Type: application/json" -X POST -d @/config/${1} https://${SPLUNK_HOST}/servicesNS/nobody/splunk_app_db_connect/db_connect/dbxproxy/inputs | grep -o "There was an error") if [ "$response" != 'There was an error' ]; then echo "Database is up" break fi printf '.' sleep 2 if [ "$i" -gt "$RETRY_MAX" ]; then echo "Database is not up" exit 1 fi done } So the argument to curl in ..."@/config/${1}"... is actually a json file that contains what I want to send as the body. Hope this helps, Tyler

tmuth_splunk · ‎03-14-2018

If DBX is installed on a search head (SH) and not a search head cluster (SHC) and this is where you're running your inputs, then in your case you would need to bounce the search head.

tmuth_splunk · ‎03-14-2018

I ran into this the other day in a docker demo environment. After bouncing the HWF, input started working again. It's worth a try if you haven't bounced it yet.

tmuth_splunk · ‎11-16-2017

Looks like you’re using an openjdk not the Oracle JDK as required in the doc. Thanks, Tyler

tmuth_splunk · ‎10-23-2017

As @DalJeanis stated, this is probably only going to work as a stored procedure or a function. DBX isn't tested against Vertica for stored procedure calls, but it might work. Take a look at this link for an example of creating a function in Vertica and calling it from a SQL statement: https://my.vertica.com/docs/7.0.x/HTML/Content/Authoring/SQLReferenceManual/Statements/CREATEFUNCTIONSQLFunctions.htm

tmuth_splunk · ‎09-20-2017

One of your examples had "select * ..." from a 2 table join. Both tables contain the column "id", so you got an ambiguous column error. The "table_alias.*" trick is nice for disambiguating select columns. For example: SELECT t1.*, t2.id as id2. t2.foo, t2.bar FROM Catalog.Table1 AS T1 LEFT OUTER JOIN Catalog.Table2 AS T2 ON T1.id = T2.id WHERE T1.id > ? ORDER BY T1.id ASC In short, give me all of the columns from t1, then get t2.id and alias it to id2 since both tables contain "id", then a few more select columns from t2.

tmuth_splunk · ‎09-20-2017

Can you try: SELECT t1.* FROM Catalog.Table1 AS T1 LEFT OUTER JOIN Catalog.Table2 AS T2 ON T1.id = T2.id WHERE T1.id > ? ORDER BY T1.id ASC

tmuth_splunk · ‎09-19-2017

Not sure you can add custom drilldowns from just a search, but you could do this in a dashboard easily. There are examples in the doc here: http://docs.splunk.com/Documentation/SplunkCloud/6.6.1/Viz/DrilldownIntro You might do it with 2 Dashboards: The 1st dashboard is just a report like you're showing above that links via drilldown to the 2nd dashboard The 2nd dashboard has a token on it called exec_id_tok. You will set that token via url from the 1st dashboard. The query on the second dashboard might look like: | dbxquery connection=some_db query="select * from some_table where execution_id = $exec_id_tok$ "

tmuth_splunk · ‎09-18-2017

Yes, DBX 3.x supports stored procedures. I’m mobile or I would send a direct link to the doc for it.

tmuth_splunk · ‎09-18-2017

It would help to know what database. If it’s one of the DBs that DBX supports for stored procedures, you could wrap all of your logic in a stored proc, then call that from DBX.

tmuth_splunk · ‎09-07-2017

I'm glad you asked that question @tmuth ! I bet you searched for an answer and didn't find exactly what you were looking for. Note that with splunk 6.5+ we can use global tokens to access environment information - link Put static content in $SPLUNK_HOME/etc/apps/your_app/appserver/static . You can also create subdirectories there. In this case I put my file in ./doc/USERGUIDE-2015.pdf , so the full path for my "abc" app is $SPLUNK_HOME/etc/apps/abc/appserver/static/doc/USERGUIDE-2015.pdf I can now reference this file using the following path in a Simple XML dashboard because of the global tokens: /static/app/$env:app$/doc/USERGUIDE-2015.pdf Below is the full code for my Simple XML dashboard: doc Documentation for this project 2015 User Guide (local copy) - [here]

tmuth_splunk · ‎09-07-2017

How do I add a static HTML panel to a simple HTML dashboard and reference local static content, such as images or PDFs? I'm on splunk 6.5+ and I'd also like to use a dynamic variable for the app name in the URL references.

tmuth_splunk · ‎07-28-2017

Splunk won't change the values of the columns in the table as it indexes them, it will set the splunk field _time to the current_index_time.

tmuth_splunk · ‎07-25-2017

You can only assign one column as the indexed timestamp or _time field. This also applies to the concept of "rising column". You can still index the other timestamp columns, but the date-time picker in the splunk UI won't filter on those. You'll have to use SPL to filter on the other timestamp columns.

Posts	39
Solutions	4
Karma Given	1
Karma Received	21
Member Since	‎11-23-2015

Online Status	Offline
Date Last Visited	‎04-09-2021 05:31 PM

Add static HTML panel to simple HTML dashboard and...

Why is Splunk Stream 7.x not capturing localhost /...

Re: Is it possible to run a curl command on a dbxq...

Re: Splunk DB Connect: How to create a batch input...

Re: The Procedure stored in Oracle does not work o...

Re: How can I use DDL in DBX3?

Re: DB input stopped after changing rising column ...

Re: ROW_NUMBER() works in DBX 2.4.1 to create a ri...

Re: ROW_NUMBER() works in DBX 2.4.1 to create a ri...

Re: ROW_NUMBER() works in DBX 2.4.1 to create a ri...

Re: Splunk DB Connect : Why am I getting this erro...

Re: Is ODA X5 Splunk compatible with Oracle Linux ...

Re: DBX 3 running out of connections in pool

Re: Using Ansible uri module to add users to splun...

Re: Splunk DB Connect: Why does DB Connect no long...

Re: Splunk DB Connect: Why does DB Connect no long...

Re: Connection invalid - Splunk DB Connect 3.1.0

Re: Splunk DB Connect: Can I run a truncate table ...

Re: DBConnect 3.1 query with JOINS, Alias', non-* ...

Re: DBConnect 3.1 query with JOINS, Alias', non-* ...

Re: How do I create a custom drill down menu optio...

Re: Splunk DB Connect: Input and temp tables

Re: Splunk DB Connect: Input and temp tables

Re: Add static HTML panel to simple HTML dashboard...

Add static HTML panel to simple HTML dashboard and...

Re: When Setting of DbConnect Input

Re: When Setting of DbConnect Input