DB Connect - Oracle - Single quote in query

johnoxley_liqui — Tue, 08 Apr 2014 14:12:04 GMT

I am have the following stanza in my inputs.conf.

[dbmon-tail://DB/TABLE]
interval = 1m
query = SELECT SL_UID,SL_TIMESTAMP,from_tz(SL_TIMESTAMP, 'Europe/London') AT TIME ZONE 'UTC' AS SL_TIMESTAMP_UTC FROM schema.TABLE {{WHERE $rising_column$ > ?}}
tail.rising.column = SL_UID
output.format = kv
output.timestamp.column = SL_TIMESTAMP
sourcetype = mydata
disabled = 0
index=test

When I run the query from Oracle's SQL Developer, I get the expected one hour difference between SL_TIMESTAMP and SL_TIMESTAMP_UTC.

The output from Splunk DBX is

2014-04-08T15:00:45.000 SL_UID=21342912 SL_TIMESTAMP_UTC=

Having decompiled dbx.jar, I think the problem is in com.splunk.util.Utils.unescapeString() not unescaping the single quote ' correctly.

Is this a bug or have I configured something incorrectly?

Re: DB Connect - Oracle - Single quote in query

pmdba — Tue, 03 Jun 2014 00:39:51 GMT

Single quotes can be escaped with a back slash: \'

topic Re: DB Connect - Oracle - Single quote in query in Splunk Search

DB Connect - Oracle - Single quote in query

Re: DB Connect - Oracle - Single quote in query