https://community.splunk.com/t5/Getting-Data-In/dbconnect-ms-sql-timestamp-error/m-p/257399#M49429 <P>the idea is to convert the epoch time. Good thing to know : epoch time on win!=epochtime on linux....<BR /> the sql command that did the trick is : dateadd<BR /> and also divide by 1000 to get the epoch time in second instead of ms</P> <PRE><CODE>dateadd(second, mysqlfield/1000,'19700101') </CODE></PRE> Fri, 27 Nov 2015 16:04:36 GMT sduchene_splunk 2015-11-27T16:04:36Z https://community.splunk.com/t5/Getting-Data-In/dbconnect-ms-sql-timestamp-error/m-p/257398#M49428 <P>Hello, Question + answers here :<BR /> We were using dbconnect 2 for a MS sql query. the column used for the timestamp was giving us an error BIGINT.<BR /> (you can see it by typing index=_internal sourcetype=<EM>dbx2</EM> error )<BR /> The trick is to convert the MS SQL epoch time, wich is in millinsecond, to a linux epoch time, in second, so that splunk can understand the time.<BR /> How do we do this ? answer below. hope it's useful for you</P> Fri, 27 Nov 2015 15:59:24 GMT https://community.splunk.com/t5/Getting-Data-In/dbconnect-ms-sql-timestamp-error/m-p/257398#M49428 sduchene_splunk 2015-11-27T15:59:24Z https://community.splunk.com/t5/Getting-Data-In/dbconnect-ms-sql-timestamp-error/m-p/257399#M49429 <P>the idea is to convert the epoch time. Good thing to know : epoch time on win!=epochtime on linux....<BR /> the sql command that did the trick is : dateadd<BR /> and also divide by 1000 to get the epoch time in second instead of ms</P> <PRE><CODE>dateadd(second, mysqlfield/1000,'19700101') </CODE></PRE> Fri, 27 Nov 2015 16:04:36 GMT https://community.splunk.com/t5/Getting-Data-In/dbconnect-ms-sql-timestamp-error/m-p/257399#M49429 sduchene_splunk 2015-11-27T16:04:36Z