topic Re: Splunk DB Connect 2: Oracle does not input data in index in All Apps and Add-ons

Splunk DB Connect 2: Oracle does not input data in index

italogf — Thu, 21 May 2015 18:13:44 GMT

I am trying to make an select and input this data into splunk.

In preview, i can see all data that i need but when job run to input data, nothing happens the data doesn't appear in the index

Re: Splunk DB Connect 2: Oracle does not input data in index

italogf — Mon, 28 Sep 2020 20:00:35 GMT

input.conf

[mi_input://Coleta]
connection = SM9
description = Coleta
index = oracle_servicecenter
input_timestamp_column_name = OPEN_TIME
input_timestamp_column_number = 1
input_timestamp_format = 2015/05/19 20/:57:02
interval = 24 * * * *
max_rows = 1000000
mode = tail
output_timestamp_format = YYYY-MM-dd HH:mm:ss
query = select * from log_report_adm.v_sm_open_documents
source = /opt/splunk/var/log/splunk/rpc.log
sourcetype = coleta_oracle_incidentes
ui_query_catalog = NULL
ui_query_mode = advanced
tail_rising_column_name = IDENTIFICADOR
tail_rising_column_number = 5
ui_query_schema = SPLUNK_SMUBR
tail_follow_only = 1

Re: Splunk DB Connect 2: Oracle does not input data in index

dolivasoh — Mon, 28 Sep 2020 20:00:37 GMT

I thought I had the answer thinking you were using dbconnect1 but now I can see you are definitely using dbconnect2.

One of the main thing to check is to be sure your data isn't older than 2000 days as there is a default limit in the app out of the box.

Note: Be aware that DB Connect abides by the MAX_DAYS_AGO setting in the Splunk Enterprise props.conf file. When set, MAX_DAYS_AGO defines the number of days in the past, from the current date, that a date is considered valid. This means that any imported records with timestamps before today's date minus MAX_DAYS_AGO will not be indexed. The default setting for MAX_DAYS_AGO is 2000 days, so if you use DB Connect to consume database data that is older than that, you should increase that value in props.conf.

Secondly and the most likely is your input timestamp format. See below

input_timestamp_format = <value>
* optional
* specify the format of input timestamp column, in JavaSimpleDateString format.

Re: Splunk DB Connect 2: Oracle does not input data in index

italogf — Mon, 28 Sep 2020 20:04:04 GMT

Yes i'm using db connect v2.

my data are something around 2008 until now

i dont understand very right this field timestamp input_timestamp_format i cant input the format like YYYY-MM-dd HH:mm:ss I need to put real date to this field be valid like this 2015/05/19 20:57:02

i try put like this input_timestamp_format = YYY/MM/dd HH:mm:ss but splunk db connect don't accept.

Re: Splunk DB Connect 2: Oracle does not input data in index

jcoates_splunk — Sat, 30 May 2015 21:10:42 GMT

the presence of a rising column value makes me wonder if it's decided that you've already gotten all of the data.

is that a good rising column (where each row has a unique value for that column)?
are there greater than 5 rows?

Re: Splunk DB Connect 2: Oracle does not input data in index

antonyhan — Fri, 17 Jul 2015 19:30:18 GMT

I have same problem....