topic Re: EPOCH CONVERSION IN ORACLE QUERY in Splunk Search

EPOCH CONVERSION IN ORACLE QUERY

harshavrath — Mon, 28 Sep 2020 16:20:17 GMT

Hi,

I need to convert the EPOCH Time using Oracle Query,by using DB Query i have figured out using the below query it can be done

|dbquery DB_NAME limit=10 "Select * from Table_NM" |fieldformat NEW_CREATED_DT=strftime(CREATED_DT,"%d-%m-%y %H:%M:%S")

But i want the query that can be used in Oracle.

Any Help is Appreciated,

Thanks.

Re: EPOCH CONVERSION IN ORACLE QUERY

linu1988 — Tue, 08 Apr 2014 09:48:45 GMT

oracle is not doing the time conversion its splunk which is converting the date field. you need to do the above to get the human readable format.

Re: EPOCH CONVERSION IN ORACLE QUERY

harshavrath — Tue, 08 Apr 2014 10:06:45 GMT

I need the query as i would be using it to input a table & index into Splunk.

Re: EPOCH CONVERSION IN ORACLE QUERY

linu1988 — Tue, 08 Apr 2014 11:03:30 GMT

if it is the summary index you can use as it is in a savedsearch. If you are trying to use dbmon then the sql query will index and while tabulating or creating dashboard you have to do the time conversion again.

Re: EPOCH CONVERSION IN ORACLE QUERY

harshavrath — Tue, 08 Apr 2014 11:30:43 GMT

Sorry linu i couldn't understand you, can you be a bit more specific.

Re: EPOCH CONVERSION IN ORACLE QUERY

harshavrath — Tue, 08 Apr 2014 11:32:11 GMT

I will be indexing my DB table under DB Inputs.Using Input_Type=tail.

Re: EPOCH CONVERSION IN ORACLE QUERY

harshavrath — Mon, 28 Sep 2020 16:21:23 GMT

I found the answer myself just to_char(date_attribute,'YYYY-MM-DD HH24:MI:SS')date_attribute will work no need of trying to convert it by multiplying & dividing the current time with 1970.

Re: EPOCH CONVERSION IN ORACLE QUERY

linu1988 — Thu, 10 Apr 2014 21:45:49 GMT

yes because ,thats no longer a date field. but a good trick