Splunk DB Connect 2 installed on a heavy forwarder, dbxquery creates a lookup table (see below), my search heads needs to access lookup table.
**Splunk Lookup Table Creation Command**
| dbxquery query="SELECT * FROM RADOPDASHPRD.DEPARTMENT" connection="Reimagining_Ambulatory_Design" maxrows=1000 shortnames=t wrap=true
| outputlookup RAD_DEPARTMENT_DETAILS_BY_DEPT_ID.csv append=false
↧