JDBC Driver for Splunk

Build 22.0.8462

UploadedModel

An example of a table object inside a data model.

Select

This is an example of a view generated from a table object inside a data model. The driver will use the Splunk APIs to process the following query components; the driver processes other parts of the query client-side in memory.

All columns support server-side processing for the following operators and functions.

  • Operators: =, <, >, >=, <=, IN, IS NULL, IS NOT NULL, NOT
  • Functions: AVG, SUM, MIN, MAX, COUNT, STDEV, STDEVP, VAR, VARP

LIMIT, ORDER BY, GROUP BY, and HAVING are also processed server-side. An exception is the case when in the selected columns, there are fields that are not in the GROUP BY, and GROUP BY, criteria, and limiting are handled client-side.

In the case when an unsupported criteria or function is used, all processing will be completed client-side (except selecting specified fields). This is also the case when a SELECT statement has a column that is not in the GROUP BY clause.

For example, the following queries are processed server side:

SELECT Component, Timeendpos as Timeend FROM [UploadedModel] WHERE Component = 'Saved' OR DEST_CITY_MARKET_ID != '' AND DEST_AIRPORT_ID NOT IN ('1', '2') ORDER BY ORIGIN_AIRPORT_ID DESC LIMIT 5 

SELECT AVG(DEST_AIRPORT_ID), ORIGIN_AIRPORT_ID FROM [UploadedModel] GROUP BY ORIGIN_AIRPORT_ID HAVING AVG(DEST_AIRPORT_ID) > 0 
You can turn off the client-side execution of the query by setting SupportEnhancedSQL to false in which case any search criteria that refers to other columns will cause an error or inconsistent data.

Columns

Name Type Description
_time Datetime
DEST_AIRPORT_ID Int
DEST_AIRPORT_SEQ_ID Int
DEST_CITY_MARKET_ID Int
host String
linecount Int
ORIGIN_AIRPORT_ID Int
ORIGIN_AIRPORT_SEQ_ID Int
ORIGIN_CITY_MARKET_ID Int
punct String
source String
sourcetype String
splunk_server String
timestamp String

Copyright (c) 2023 CData Software, Inc. - All rights reserved.
Build 22.0.8462