Splunk Search

dboutput bug updating MySQL

richgalloway
SplunkTrust
SplunkTrust

I'm using DB Connect to send search results to MySQL. My search command is:

... | dboutput type=update notFound=insert database=mydb table=mytable fields=IPAddress AS ip, NetAddress AS mac, ComputerName AS device_name,
 Manufacturer AS manufacturer, Model AS model_name key=ip,mac *

This produces the error message "No value specified for parameter 1". Turning on debug logging I see the following query is generated:

UPDATE mytable SET `AS`=$AS$, ip=$ip$, NetAddress=$NetAddress$, ComputerName=$ComputerName$, Manufacturer=$Manufacturer$, Model=$Model$, mac=$mac$, IPAddress=$IPAddress$ WHERE ip = $ip$

Notice the 'AS' column was inserted. Where did it come from and how do I get rid of it?

Also, my key argument specified two fields, but only one appears in the query. Is that another bug or something I did wrong?

---
If this reply helps you, Karma would be appreciated.
0 Karma

Dan
Splunk Employee
Splunk Employee

You can't currently have multiple key values for the update to occur on. This is one of the things we might add when we make dboutput GA.

0 Karma

cramasta
Builder

trying to get my hands on the mysql connector, I dont think it has this limitation.

0 Karma

cramasta
Builder

FYI, finding out that trying to use type=update will fail when Splunk results are more than 100 rows. Seems that type=insert is able to run batches of 100 but type=update doesn't know how to run batches and the max that will work is whatever the setting is in the java.conf file for batch size

Here is the error you would see ( i updated the batch size to 105 and tried exporting 108 rows, exporting 104 rows would work)

command="dboutput", Unexpected error while performing dboutput: java.lang.ArrayIndexOutOfBoundsException: 105

0 Karma

cramasta
Builder

I would be interested in knowing if you can actually provide two key values for the update to occur on.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...