<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Is it possible to get concat fields through db connect? in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-get-concat-fields-through-db-connect/m-p/585048#M102942</link>
    <description>&lt;P&gt;Hello. I need help with DB data input.&lt;/P&gt;&lt;P&gt;Among the fields of the mariadb table, the field related to time is divided into two.&lt;/P&gt;&lt;P&gt;Both fields are of type varchar.&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;1) The date field stores today's date. ex) 2022215&lt;/P&gt;&lt;P&gt;2)&amp;nbsp;The time field stores the time. Leading zeros are omitted.&lt;/P&gt;&lt;P&gt;ex) 110203000 (hhmmssSSS)&lt;/P&gt;&lt;P&gt;For time fields, leading zeros are omitted.&amp;nbsp;&amp;nbsp;In the case of 00:02:03, it becomes as follows.&lt;/P&gt;&lt;P&gt;ex) 203000&amp;nbsp;&lt;/P&gt;&lt;P&gt;As a side note, I know these configurations aren't common, I didn't create them.&lt;/P&gt;&lt;P&gt;In the above situation, to get data through the rising column, the query is structured as follows.&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;select concat(date,lpad(time,'9','0')) as time from ~~~ where time &amp;gt; 1&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;If i execute a query on the db connect setting screen, data is imported normally.&lt;/P&gt;&lt;P&gt;However, once the setup is complete and the query is run on a schedule, the data will not be indexed.&lt;/P&gt;&lt;P&gt;In db connect, if data is artificially processed through a query, can't I get data?&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;thank you.&lt;/P&gt;</description>
    <pubDate>Tue, 15 Feb 2022 01:53:40 GMT</pubDate>
    <dc:creator>ragonfly</dc:creator>
    <dc:date>2022-02-15T01:53:40Z</dc:date>
    <item>
      <title>Is it possible to get concat fields through db connect?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-get-concat-fields-through-db-connect/m-p/585048#M102942</link>
      <description>&lt;P&gt;Hello. I need help with DB data input.&lt;/P&gt;&lt;P&gt;Among the fields of the mariadb table, the field related to time is divided into two.&lt;/P&gt;&lt;P&gt;Both fields are of type varchar.&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;1) The date field stores today's date. ex) 2022215&lt;/P&gt;&lt;P&gt;2)&amp;nbsp;The time field stores the time. Leading zeros are omitted.&lt;/P&gt;&lt;P&gt;ex) 110203000 (hhmmssSSS)&lt;/P&gt;&lt;P&gt;For time fields, leading zeros are omitted.&amp;nbsp;&amp;nbsp;In the case of 00:02:03, it becomes as follows.&lt;/P&gt;&lt;P&gt;ex) 203000&amp;nbsp;&lt;/P&gt;&lt;P&gt;As a side note, I know these configurations aren't common, I didn't create them.&lt;/P&gt;&lt;P&gt;In the above situation, to get data through the rising column, the query is structured as follows.&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;select concat(date,lpad(time,'9','0')) as time from ~~~ where time &amp;gt; 1&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;If i execute a query on the db connect setting screen, data is imported normally.&lt;/P&gt;&lt;P&gt;However, once the setup is complete and the query is run on a schedule, the data will not be indexed.&lt;/P&gt;&lt;P&gt;In db connect, if data is artificially processed through a query, can't I get data?&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;thank you.&lt;/P&gt;</description>
      <pubDate>Tue, 15 Feb 2022 01:53:40 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-get-concat-fields-through-db-connect/m-p/585048#M102942</guid>
      <dc:creator>ragonfly</dc:creator>
      <dc:date>2022-02-15T01:53:40Z</dc:date>
    </item>
    <item>
      <title>Re: Is it possible to get concat fields through db connect?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-get-concat-fields-through-db-connect/m-p/585060#M102947</link>
      <description>&lt;P&gt;* You have to add a question mark (&lt;STRONG&gt;?&lt;/STRONG&gt;) with where condition and DB Connect would replace the checkpoint value of rising column there. (Please read the instruction in the UI just below the rising column option.)&lt;/P&gt;&lt;P&gt;* You can apply it on artificially generated columns. But last time when I had a similar situation I couldn't able to do it through UI. So I had to create input start in db_inputs.conf from the backend.&lt;/P&gt;</description>
      <pubDate>Tue, 15 Feb 2022 06:03:54 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-get-concat-fields-through-db-connect/m-p/585060#M102947</guid>
      <dc:creator>VatsalJagani</dc:creator>
      <dc:date>2022-02-15T06:03:54Z</dc:date>
    </item>
  </channel>
</rss>

