After migrating from Splunk DB Connect version 1 to version 2, why does the app handle date time differently than the previous version?

[groland]

Hi everyone,

When I used Splunk DB Connect v1 on MS SQL, I was able to something like that (very simplified):

| dbquery mssql "SELECT GETDATE() AS getdate" | eval _time = getdate | timechart count

But with Splunk DB Connect v2, the datetime is output as string and wasn't recognized as a timestamp, so this doesn't work anymore:

| dbxquery connection=mssql query="SELECT GETDATE() AS getdate" | eval _time = getdate | timechart count

The workaround is to convert the date to timestamp before using it in the timechart:

| dbxquery connection=mssql shortnames=t query="SELECT GETDATE() AS getdate" | eval getdate = strptime(getdate, "%Y-%m-%d %H:%M:%S.%3Q") | eval _time = getdate | timechart count

Is this a desired feature or an issue on my side?

Thanks!

[jcoates_splunk · Accepted solution]

Hi,

This is intentional. The documentation under "Choose Column" in http://docs.splunk.com/Documentation/DBX/3.0.0/DeployDBX/Createandmanagedatabaseinputs#Set_parameter... covers the current behavior for this feature.

[groland]

Hi,

Thanks for the answer. Maybe things have changed now with DBX 3.0.0 (I haven't tested).
For the documentation, is seem talking about the inputs and on my side, I've an issue with the dbxquery so those parameters aren't available (because it's not indexation).