I'm trying to replicate the lookup tables in old Splunk DB Connect v1 add-on into Splunk DB Connect v2.4.0 add-on.I need a lookup on this table in new DB v2.4.0 to fetch and relate the feilds in our splunk events.
My SQL query has $field$ -- advanced lookup input field "$field$" from the previous DB v1 and DB lookup query is as follows
SELECT Meta_LogDate, FirstName, LastName,User_Name, Region
FROM SCHEMA.COMPANY
WHERE User_Name = $NAME$
SELECT col1,col2,col3,col4,col5,col6,col7 FROM SCHEMA.TABLE_VIEW WHERE col1=$Name$.
When i try to run the query to create a DB lookup it throws an SQL errors ,
params: "None", caused by: Exception(' java.sql.SQLSyntaxErrorException: ORA-00904: "Name": invalid identifier\n.',).
How can i create db look up using the $Name$ feild which is throwing error? And , add parameters to the advanced query when creating the lookup.Is it necessary to create inputs as a next step to create a DB lookup .
I tried creating db lookup and later advanced input through Splunk Web.
Appreciate your answers .Thanks In advance.
↧