topic Re: After migrating from Splunk DB Connect version 1 to version 2, why does the app handle date time differently than the previous version? in All Apps and Add-ons

After migrating from Splunk DB Connect version 1 to version 2, why does the app handle date time differently than the previous version?

groland — Tue, 17 Jan 2017 18:07:42 GMT

Hi everyone,

When I used Splunk DB Connect v1 on MS SQL, I was able to something like that (very simplified):

| dbquery mssql "SELECT GETDATE() AS getdate" | eval _time = getdate | timechart count

But with Splunk DB Connect v2, the datetime is output as string and wasn't recognized as a timestamp, so this doesn't work anymore:

| dbxquery connection=mssql query="SELECT GETDATE() AS getdate" | eval _time = getdate | timechart count

The workaround is to convert the date to timestamp before using it in the timechart:

| dbxquery connection=mssql shortnames=t query="SELECT GETDATE() AS getdate" | eval getdate = strptime(getdate, "%Y-%m-%d %H:%M:%S.%3Q") | eval _time = getdate | timechart count

Is this a desired feature or an issue on my side?

Thanks!

Re: After migrating from Splunk DB Connect version 1 to version 2, why does the app handle date time differently than the previous version?

jcoates_splunk — Thu, 23 Feb 2017 20:36:22 GMT

Hi,

This is intentional. The documentation under "Choose Column" in http://docs.splunk.com/Documentation/DBX/3.0.0/DeployDBX/Createandmanagedatabaseinputs#Set_parameters covers the current behavior for this feature.

Re: After migrating from Splunk DB Connect version 1 to version 2, why does the app handle date time differently than the previous version?

groland — Fri, 24 Feb 2017 08:56:25 GMT

Hi,

Thanks for the answer. Maybe things have changed now with DBX 3.0.0 (I haven't tested).
For the documentation, is seem talking about the inputs and on my side, I've an issue with the dbxquery so those parameters aren't available (because it's not indexation).