topic Splunk DB Connect Bug in Knowledge Management

Splunk DB Connect Bug

linu1988 — Thu, 04 Jul 2013 10:05:31 GMT

Good Morning/Afternoon to all!!

I have a query regarding the dataset returned by |dbquery. If the Database has a time field while viewing the result it shows wrong value which it converts to some other format like "1370428834.360"
for the date "21/06/13 15:41:24". I can apply in the search tab to convert it into proper timestamp.

Now the question is how can i do it on the dashboard itself as the column names will not be the same for every table..

Thanks for your attention.

Re: Splunk DB Connect Bug

pmdba — Sat, 03 Aug 2013 17:52:20 GMT

If a datetime column is returned as part of your query you must convert it to a text datatype, otherwise Splunk will display it as a number. For example, in Oracle, use the "to_char" function in the query to convert to the text format you want:

select to_char(datetime_field_name,'DD/MM/YY HH24:MI:SS') "display_col_name" from table_name;

This would return the value of the datetime_field_name column in the table_name table in the format you listed in your original question.

Re: Splunk DB Connect Bug

linu1988 — Sun, 04 Aug 2013 06:01:26 GMT

But this is not a solution!! Who will change their DB just to show the content in Splunk? Date Time should be recognized automatically and shown as it is rather than epoch format. Btw Thank you for your time.

Re: Splunk DB Connect Bug

pmdba — Mon, 05 Aug 2013 14:02:30 GMT

I would suggest that different databases may not store datetime information in the same format. Splunk is primarily designed to index and search text, not other datatypes. Changing your query to format the results in a way Splunk can read it correctly is not "changing your database," since the underlying data has not changed at all.