All Apps and Add-ons

Splunk DB Connect: How do I use epoch time when extracting the data time information?

alexwade13
Engager

Hi, I'm trying to figure out what to put in the DateTime format spot when set the SQL query and setting a rising column. The test says "Specify the format to extract the date time information (eg: dd/MM/yyyy HH:mm:ss.SSS) or cast the column to timestamp manually in your query." How do I get it to use Epoch time instead? Also, there are 3 milliseconds after the epoch time. I know the time format in props would be %s%3N, but that is not applicable here. Thanks!

0 Karma

bambarit
Explorer

?have you resolved epoch timestamp?

0 Karma

bambarit
Explorer

have you resolved epoch timestamp?

0 Karma

sshres5
Communicator

I got this working by using the following:
SELECT CAST(date '1970-01-01' + (1/24/60/60/1000) *epoch_column AS timestamp) AS date_time, epoch_column

0 Karma

splunk_zen
Builder

Any solution to this?
Shouldn't DB connect actually prefer an epoch rising column rather than a human converted format as it's constantly evaluating for a higher value?

0 Karma

splunk_zen
Builder

Seems it just needs to be a DATETIME type and this goes away

0 Karma

EmEdwards
Path Finder

I am using a new version of DB connect 3.1.1 and seems even though I have a datetime datatype from SQL it still wont accept the column and requests a format.
I can't seem to get it to work.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...