Splunk® DB Connect

Deploy and Use Splunk DB Connect

Download manual as PDF

NOTE - Splunk DB Connect version 1.x reached its End of Life on July 28, 2016. Please see the migration information.
This documentation does not apply to the most recent version of DBX. Click here for the latest version.
Download topic as PDF


# Copyright (C) 2005-2012 Splunk Inc. All Rights Reserved.
# This file contains the configured database lookup definitions


database = <database>
* The database. References a stanza in database.conf

table = <string>
* The database table name. Only used in simple mode (advanced = 0).

fields = <csv-list>
* A list of fields/columns for the lookup
* You can specify the field only, or both the field and the column in the form: <field> as <sql-column>

advanced = [1|0]
* Whether to perform a simple lookup against the table or use a custom SQL query

query = <string>
* A SQL query template. Expressions in the form of $fieldname$ are replaced with the input provided by splunk.

input_fields = <csv-list>
*  list of fields/columns for as input for the SQL query template

max_matches = <n>
* Maximum number of results fetched from the database for each lookup input row
* Defaults to 1


This documentation applies to the following versions of Splunk® DB Connect: 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.11, 1.1, 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.5, 1.1.6, 1.1.7, 1.2.0, 1.2.1, 1.2.2

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters