<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: DB Connect issue in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/DB-Connect-issue/m-p/549744#M91308</link>
    <description>&lt;P&gt;I've been facing exactly the same issue reading data from 1 of 2 DB views (Ora 19). One was working OK, second one was having this issue. The only difference was a position of EVENT_TIMESTAMP column in view definition. One that was working OK had rising column (date) as first, second one had it as last column in view definition. I've redefined second view (moved EVENT_TIMESTAMP as first column) and error disappeared.&lt;/P&gt;&lt;P&gt;Full listing of columns tested at first without any success.&amp;nbsp;&lt;/P&gt;</description>
    <pubDate>Thu, 29 Apr 2021 05:50:01 GMT</pubDate>
    <dc:creator>jakubzak</dc:creator>
    <dc:date>2021-04-29T05:50:01Z</dc:date>
    <item>
      <title>DB Connect issue</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/DB-Connect-issue/m-p/532541#M89520</link>
      <description>&lt;P&gt;I have been given this query to get data into dbconnect, it works perfectly fine for batch, but i want to run and get results for rising column by using EVENT_TIME from January 1st 2020. what should be added to the below query, i tried adding&amp;nbsp;AND EVENT_TIME &amp;gt; ?&lt;BR /&gt;ORDER BY EVENT_TIME DESC and it gives&amp;nbsp;&lt;SPAN&gt;java.sql.SQLDataException: ORA-01861: literal does not match format string. If i change EVENT_TIME to EVENT_NAME it works but i want rising column value for event time . Please help&amp;nbsp;&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;SELECT&lt;BR /&gt;sa.main_location AS main_location,&lt;BR /&gt;sa.sub_location AS sub_location,&lt;BR /&gt;sa.event_name AS event_name,&lt;BR /&gt;sa.event_type AS event_type,&lt;BR /&gt;to_char (sa.event_time, 'mm/dd/yyyy hh24:mi:ss') AS event_time,&lt;BR /&gt;sa.entity_type AS entity_type,&lt;BR /&gt;su.sys_user_id AS rac&lt;BR /&gt;FROM jiva.security_audit_info sa&lt;BR /&gt;LEFT JOIN jiva.sys_user su ON su.user_idn = sa.user_idn&lt;BR /&gt;LEFT JOIN jiva.entity e ON e.entity_idn = su.entity_idn&lt;BR /&gt;WHERE sa.event_name IN (&lt;BR /&gt;'user_login',&lt;BR /&gt;'user_logout'&lt;BR /&gt;)&lt;/P&gt;</description>
      <pubDate>Wed, 09 Dec 2020 22:12:13 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/DB-Connect-issue/m-p/532541#M89520</guid>
      <dc:creator>vpantangi</dc:creator>
      <dc:date>2020-12-09T22:12:13Z</dc:date>
    </item>
    <item>
      <title>Re: DB Connect issue</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/DB-Connect-issue/m-p/532548#M89522</link>
      <description>&lt;P&gt;Give this a try&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;SELECT
sa.main_location AS main_location,
sa.sub_location AS sub_location,
sa.event_name AS event_name,
sa.event_type AS event_type,
to_char (sa.event_time, 'mm/dd/yyyy hh24:mi:ss') AS event_time,
sa.entity_type AS entity_type,
su.sys_user_id AS rac
sa.event_time AS rising_column
FROM jiva.security_audit_info sa
LEFT JOIN jiva.sys_user su ON su.user_idn = sa.user_idn
LEFT JOIN jiva.entity e ON e.entity_idn = su.entity_idn
WHERE sa.event_name IN (
'user_login',
'user_logout'
) WHERE rising_column &amp;gt; ?&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;You had formatted EVENT_TIME value to string and that's the reason oracle was having hard time casting it to DATETIME /TIMESTAMP for rising column comparison. Create a new column to be used&amp;nbsp; for that.&lt;/P&gt;</description>
      <pubDate>Wed, 09 Dec 2020 22:35:39 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/DB-Connect-issue/m-p/532548#M89522</guid>
      <dc:creator>somesoni2</dc:creator>
      <dc:date>2020-12-09T22:35:39Z</dc:date>
    </item>
    <item>
      <title>Re: DB Connect issue</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/DB-Connect-issue/m-p/532549#M89523</link>
      <description>&lt;P&gt;it gives this error "&lt;SPAN&gt;java.sql.SQLException: Missing IN or OUT parameter at index:: 1"&lt;/SPAN&gt;&lt;/P&gt;</description>
      <pubDate>Wed, 09 Dec 2020 22:39:22 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/DB-Connect-issue/m-p/532549#M89523</guid>
      <dc:creator>vpantangi</dc:creator>
      <dc:date>2020-12-09T22:39:22Z</dc:date>
    </item>
    <item>
      <title>Re: DB Connect issue</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/DB-Connect-issue/m-p/532555#M89524</link>
      <description>&lt;P&gt;Give this a try&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;SELECT * FROM (SELECT
sa.main_location AS main_location,
sa.sub_location AS sub_location,
sa.event_name AS event_name,
sa.event_type AS event_type,
to_char (sa.event_time, 'mm/dd/yyyy hh24:mi:ss') AS event_time,
sa.entity_type AS entity_type,
su.sys_user_id AS rac
sa.event_time AS rising_column
FROM jiva.security_audit_info sa
LEFT JOIN jiva.sys_user su ON su.user_idn = sa.user_idn
LEFT JOIN jiva.entity e ON e.entity_idn = su.entity_idn
WHERE sa.event_name IN (
'user_login',
'user_logout'
)) ev WHERE rising_column &amp;gt; ?&lt;/LI-CODE&gt;</description>
      <pubDate>Wed, 09 Dec 2020 23:19:36 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/DB-Connect-issue/m-p/532555#M89524</guid>
      <dc:creator>somesoni2</dc:creator>
      <dc:date>2020-12-09T23:19:36Z</dc:date>
    </item>
    <item>
      <title>Re: DB Connect issue</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/DB-Connect-issue/m-p/532558#M89525</link>
      <description>&lt;P&gt;Same error, i noticed something new when pasting the queries you sent, previously i was able to select values in rising column section, now it shows no results.&lt;/P&gt;</description>
      <pubDate>Wed, 09 Dec 2020 23:24:17 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/DB-Connect-issue/m-p/532558#M89525</guid>
      <dc:creator>vpantangi</dc:creator>
      <dc:date>2020-12-09T23:24:17Z</dc:date>
    </item>
    <item>
      <title>Re: DB Connect issue</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/DB-Connect-issue/m-p/549744#M91308</link>
      <description>&lt;P&gt;I've been facing exactly the same issue reading data from 1 of 2 DB views (Ora 19). One was working OK, second one was having this issue. The only difference was a position of EVENT_TIMESTAMP column in view definition. One that was working OK had rising column (date) as first, second one had it as last column in view definition. I've redefined second view (moved EVENT_TIMESTAMP as first column) and error disappeared.&lt;/P&gt;&lt;P&gt;Full listing of columns tested at first without any success.&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Thu, 29 Apr 2021 05:50:01 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/DB-Connect-issue/m-p/549744#M91308</guid>
      <dc:creator>jakubzak</dc:creator>
      <dc:date>2021-04-29T05:50:01Z</dc:date>
    </item>
  </channel>
</rss>

