Hi guys,
Is it possible to use the db connect lookup like inputlookup? I do not need to join the lookup data with other events and the data should always be up to date, as is always the case in the external database. this is why i dont want to use the input, because it is not possible to update the indexed data, right? i hope someone can follow me.
in my case i have to illustrate data from an external database on a splunk dashboard. the external data is triggerd from an other application and the view should always be up to date. old records are useless and annyoing in my query.
thank you so much!
cheers
↧