All Apps and Add-ons

Splunk DB connect return result as empty for string/varchar fields.


I have an issue where querying Oracle 9 DB using DB connect. All fields that are varchar returned as empty, but for numeric or date it is returning correcting. 


Say if I run on SQL explorer "Select sysdate from dual" or "select count(*) from table_A" I will get the expected result, but running "select transactionid from table_a;" it will return multiple rows  of empty data. 


And if I run "select sysdate, transactionid from table_a;" I will get sysdate correctly but transactionid field as empty. 


I try to added as input, but when I check the events all the varchar fields does not exists in the events.  Using "select sysdate, transactionid from table_a;", I can see sysdate in the event but not transactionid. 


if I run the query in SQL developer it is all working perfectly fine.

For other DB input I am using, I don't have this issue.

I have trying add the query as input, cast the varchar fields but nothing seems to work.

Just wonder if anyone has any ideas how could I work around this? 


Below is the information of DB and Splunk:

DB is Oracle - Version:
Splunk Version: 7.2.5

Current Application: Splunk DB Connect
App Version 3.1.3

Labels (1)


Found a workaround, not sure why this happens but if I cast the varchar field to char it will work. 

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!