https://community.splunk.com/t5/Knowledge-Management/Column-names-with-Oracle-and-DB-Connect/m-p/410306#M6446 <P>Assign the events to a sourcetype which has KV_MODE=auto to get the fields and values automatically extracted. If not, use REGEX to get them on the sourcetype level too</P> Wed, 27 Feb 2019 15:56:00 GMT tiagofbmm 2019-02-27T15:56:00Z https://community.splunk.com/t5/Knowledge-Management/Column-names-with-Oracle-and-DB-Connect/m-p/410303#M6443 <P>I have a DB Connect input: <CODE>SELECT EVENT_ID, EVENT_TYPE, ... FROM table WHERE EVENT_ID &gt; ? ORDER BY EVENT_ID ASC</CODE>. <BR /> The fields in the result all come with a column name, eg: <BR /> EVENT_ID="225894621", EVENT_TYPE="QUERY_BILLS",...<BR /> EVENT_ID="225894620", EVENT_TYPE="CONN_SERVICE",... etc.</P> <P>It seems to me that it's an unnecessary overhead. Can I get rid of the column names?</P> Tue, 29 Sep 2020 23:27:03 GMT https://community.splunk.com/t5/Knowledge-Management/Column-names-with-Oracle-and-DB-Connect/m-p/410303#M6443 girtsgr 2020-09-29T23:27:03Z https://community.splunk.com/t5/Knowledge-Management/Column-names-with-Oracle-and-DB-Connect/m-p/410304#M6444 <P>No, DBConnect method of collection is to create a KV pair out of each field, no way around that</P> Wed, 27 Feb 2019 14:27:48 GMT https://community.splunk.com/t5/Knowledge-Management/Column-names-with-Oracle-and-DB-Connect/m-p/410304#M6444 tiagofbmm 2019-02-27T14:27:48Z https://community.splunk.com/t5/Knowledge-Management/Column-names-with-Oracle-and-DB-Connect/m-p/410305#M6445 <P>Too bad. What's the best way to get usefull fields out of the results - use field extraction or something else?</P> Wed, 27 Feb 2019 15:10:05 GMT https://community.splunk.com/t5/Knowledge-Management/Column-names-with-Oracle-and-DB-Connect/m-p/410305#M6445 girtsgr 2019-02-27T15:10:05Z https://community.splunk.com/t5/Knowledge-Management/Column-names-with-Oracle-and-DB-Connect/m-p/410306#M6446 <P>Assign the events to a sourcetype which has KV_MODE=auto to get the fields and values automatically extracted. If not, use REGEX to get them on the sourcetype level too</P> Wed, 27 Feb 2019 15:56:00 GMT https://community.splunk.com/t5/Knowledge-Management/Column-names-with-Oracle-and-DB-Connect/m-p/410306#M6446 tiagofbmm 2019-02-27T15:56:00Z https://community.splunk.com/t5/Knowledge-Management/Column-names-with-Oracle-and-DB-Connect/m-p/410307#M6447 <P>Great, will do that, thank you!</P> Thu, 28 Feb 2019 08:29:02 GMT https://community.splunk.com/t5/Knowledge-Management/Column-names-with-Oracle-and-DB-Connect/m-p/410307#M6447 girtsgr 2019-02-28T08:29:02Z