Splunk Enterprise 6.4.10, DB Connect 3.1.3
I'm trying to set up a new input from an Oracle database. The query works fine in a standard search, ( |dbxquery connection="oracle" query="Select blah blah blah...") but when I try to set up the input in DB Connect 3, I get an error during the "Set SQL Query" portion. When I paste in my query in the SQL Editor and Execute, I get the following error:
Error in 'SearchParser': Subsearches are only valid as arguments to commands. Error at position '352' of search query '| dbxquery query="SELECT to_char(firstoccurrence, ...{snipped} {errorcontext = e(text1,'[[:cntrl:]]|}'.
My query is as follows:
SELECT to_char(firstoccurrence,
'YYYY/MM/DD HH24:MI:SS') timestamp, to_char(lastmodified,'YYYY/MM/DD HH24:MI:SS') lastmodified, to_char(firstoccurrence,'YYYY/MM/DD HH24:MI:SS') firstoccurrence,to_char(lastoccurrence,'YYYY/MM/DD HH24:MI:SS') lastoccurrence, regexp_replace(summary,'[[:cntrl:]]|\"', '')summary, regexp_replace(text1,'[[:cntrl:]]|\"', '')text1, regexp_replace(text2,'[[:cntrl:]]|\"', '')text2, regexp_replace(text3,'[[:cntrl:]]|\"', '')text3, serial, servername, serverserial, owneruid, node, nodealias, manager, agent, location, class, poll, type, tally, severity, acknowledged, escalation, eventid, service, nename, neaddress, netype, objecttype, trapreason, customer, site, serviceidentifier, servicetype, networkname, ticketnumber, tickethost, ticketprofile, ticketflag, ticketsev, tickettime, existingincident, deletedat, originalseverity, ackat, acksec, expiretime, flash, grade, localnodealias, localpriobj,localrootobj, localsecobj, mplstype, nmoscausetype, nmosobjinst, nmosserial, objectstatus, physicalcard, physicalslot, processreq, qip, remotenodealias, remotepriobj, remoterootobj, remotesecobj, supressescl, tasklist, url, name, userid, regexp_replace(lastassignee,'[[:cntrl:]]|\"', '')lastassignee, regexp_replace(incidentsolution,'[[:cntrl:]]|\"', '')incidentsolution
FROM table1 natural
LEFT JOIN table2 natural
LEFT JOIN table3
WHERE firstoccurrence > sysdate - 90
ORDER BY lastmodified
