<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic DB connect - timestamp issue in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/DB-connect-timestamp-issue/m-p/68366#M97008</link>
    <description>&lt;P&gt;Hi,&lt;/P&gt;

&lt;P&gt;we use DB connect to monitor database jobs. Each job generates an entry. the field log_number is an increasing counter, the fiels log_entrydate is the actual timestamp.&lt;/P&gt;

&lt;P&gt;log_entrydate format: 2013-06-19 14:03:12.183506    &lt;/P&gt;

&lt;P&gt;I tried to extract the timestamp and to get an event for each log_number but was not successful. Configuration:&lt;/P&gt;

&lt;P&gt;output.timestamp = true&lt;BR /&gt;
output.timestamp.column = LOG_ENTRYDATE&lt;BR /&gt;
output.timestamp.parse.format = yyyy-MM-dd HH:mm:ss.SSS --&amp;gt; I don't know how to specify &lt;/P&gt;

&lt;P&gt;Any help is appreciated.&lt;/P&gt;

&lt;P&gt;Cheers,&lt;BR /&gt;
Andy&lt;/P&gt;</description>
    <pubDate>Mon, 28 Sep 2020 14:07:44 GMT</pubDate>
    <dc:creator>kochera</dc:creator>
    <dc:date>2020-09-28T14:07:44Z</dc:date>
    <item>
      <title>DB connect - timestamp issue</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/DB-connect-timestamp-issue/m-p/68366#M97008</link>
      <description>&lt;P&gt;Hi,&lt;/P&gt;

&lt;P&gt;we use DB connect to monitor database jobs. Each job generates an entry. the field log_number is an increasing counter, the fiels log_entrydate is the actual timestamp.&lt;/P&gt;

&lt;P&gt;log_entrydate format: 2013-06-19 14:03:12.183506    &lt;/P&gt;

&lt;P&gt;I tried to extract the timestamp and to get an event for each log_number but was not successful. Configuration:&lt;/P&gt;

&lt;P&gt;output.timestamp = true&lt;BR /&gt;
output.timestamp.column = LOG_ENTRYDATE&lt;BR /&gt;
output.timestamp.parse.format = yyyy-MM-dd HH:mm:ss.SSS --&amp;gt; I don't know how to specify &lt;/P&gt;

&lt;P&gt;Any help is appreciated.&lt;/P&gt;

&lt;P&gt;Cheers,&lt;BR /&gt;
Andy&lt;/P&gt;</description>
      <pubDate>Mon, 28 Sep 2020 14:07:44 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/DB-connect-timestamp-issue/m-p/68366#M97008</guid>
      <dc:creator>kochera</dc:creator>
      <dc:date>2020-09-28T14:07:44Z</dc:date>
    </item>
    <item>
      <title>Re: DB connect - timestamp issue</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/DB-connect-timestamp-issue/m-p/68367#M97009</link>
      <description>&lt;P&gt;What's the datatype of the &lt;CODE&gt;log_entrydate&lt;/CODE&gt; column? Is it VARCHAR (or similar) or is it an actual TIMESTAMP)?&lt;/P&gt;</description>
      <pubDate>Wed, 19 Jun 2013 15:00:40 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/DB-connect-timestamp-issue/m-p/68367#M97009</guid>
      <dc:creator>ziegfried</dc:creator>
      <dc:date>2013-06-19T15:00:40Z</dc:date>
    </item>
    <item>
      <title>Re: DB connect - timestamp issue</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/DB-connect-timestamp-issue/m-p/68368#M97010</link>
      <description>&lt;P&gt;Hi Sigi,&lt;/P&gt;

&lt;P&gt;find below the definition of the log_entrydate field.&lt;/P&gt;

&lt;P&gt;LOG_ENTRYDATE   VARCHAR2    YES     29  0   10&lt;/P&gt;

&lt;P&gt;cheers,&lt;BR /&gt;
Andy&lt;/P&gt;</description>
      <pubDate>Thu, 20 Jun 2013 05:59:49 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/DB-connect-timestamp-issue/m-p/68368#M97010</guid>
      <dc:creator>kochera</dc:creator>
      <dc:date>2013-06-20T05:59:49Z</dc:date>
    </item>
    <item>
      <title>Re: DB connect - timestamp issue</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/DB-connect-timestamp-issue/m-p/68369#M97011</link>
      <description>&lt;P&gt;DB Connect uses a SimpleDateFormat to parse the timestamp. SimpleDateFormat only support milli-seconds precision, the timestamp in your case seems to too precise (nano-seconds). There are 2 ways to work around this:&lt;/P&gt;

&lt;P&gt;1) Parse the timestamp up to the seconds (ie. reduce the precision): &lt;CODE&gt;yyyy-MM-dd HH:mm:ss&lt;/CODE&gt;, which should work&lt;BR /&gt;
2) Use a custom SQL statement and convert the &lt;CODE&gt;LOG_ENTRYDATE&lt;/CODE&gt; column to TIMESTAMP (eg. using the &lt;CODE&gt;TO_TIMESTAMP&lt;/CODE&gt; function: &lt;A href="http://docs.oracle.com/cd/B19306_01/server.102/b14200/functions193.htm"&gt;http://docs.oracle.com/cd/B19306_01/server.102/b14200/functions193.htm&lt;/A&gt;)&lt;/P&gt;</description>
      <pubDate>Thu, 20 Jun 2013 16:03:58 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/DB-connect-timestamp-issue/m-p/68369#M97011</guid>
      <dc:creator>ziegfried</dc:creator>
      <dc:date>2013-06-20T16:03:58Z</dc:date>
    </item>
    <item>
      <title>Re: DB connect - timestamp issue</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/DB-connect-timestamp-issue/m-p/68370#M97012</link>
      <description>&lt;P&gt;Hi,&lt;/P&gt;

&lt;P&gt;thanks for the hint. Finally I got a it working.&lt;/P&gt;

&lt;P&gt;1) SELECT TO_TIMESTAMP(TO_CHAR(LOG_ENTRYDATE),'YYYY-MM-DD HH24:MI:SS.FF') LOG_ENTRYDATE,&lt;BR /&gt;
2) SELECT TO_CHAR (TO_TIMESTAMP (LOG_ENTRYDATE, 'YYYY-MM-DD HH24:MI:SS,FF6'),&lt;BR /&gt;
                        'YYYY-MM-DD HH24:MI:SS.FF3')&lt;BR /&gt;
               LOG_ENTRYDATE,&lt;/P&gt;

&lt;P&gt;Both should work, for me solution 1) was just fine.&lt;/P&gt;

&lt;P&gt;Cheers,&lt;BR /&gt;
Andy&lt;/P&gt;</description>
      <pubDate>Mon, 28 Sep 2020 14:10:34 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/DB-connect-timestamp-issue/m-p/68370#M97012</guid>
      <dc:creator>kochera</dc:creator>
      <dc:date>2020-09-28T14:10:34Z</dc:date>
    </item>
    <item>
      <title>Re: DB connect - timestamp issue</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/DB-connect-timestamp-issue/m-p/68371#M97013</link>
      <description>&lt;P&gt;Sigi &amp;amp; kochera, your science is pure and appreciated.  I tweaked solution slightly for MS-SQL.  I'll paste those configs here for anyone else querying MS-SQL.&lt;/P&gt;

&lt;P&gt;Query Snippet:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;SELECT
CAST([EPOEvents].[ReceivedUTC] as varchar) as [timestamp],
...
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Respective parameters in inputs.conf:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;output.timestamp = 1
output.timestamp.column = timestamp
# format for writing event:  2012-08-03 08:17:00
output.timestamp.format = yyyy-MM-dd HH:mm:ss
# format for translating date from query results:  Aug  3 2012  8:17AM
output.timestamp.parse.format = MMM dd yyyy HH:mmaa
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Relevant bit from props.conf:&lt;BR /&gt;
    TIME_FORMAT=%Y-%m-%d %H:%M:%S&lt;BR /&gt;
    TZ=UTC&lt;/P&gt;</description>
      <pubDate>Fri, 28 Jun 2013 15:39:27 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/DB-connect-timestamp-issue/m-p/68371#M97013</guid>
      <dc:creator>bwooden</dc:creator>
      <dc:date>2013-06-28T15:39:27Z</dc:date>
    </item>
  </channel>
</rss>

