Splunk DBConnect App - not reading timestamp column value correctly

[splunkears]

This is related to Splunk DB Connect App. While configuring a table with Timestamp column, the timestamp is not getting into effect at the time of indexing, by Splunk.

For example, the table being indexed has say, timestamp value in year, say 2008. After indexing the table, any time charts created using this data is showing timestamp of current time than timestamp in 2008. All all events indexed for this table, fall (wrongly) in the same day & time of indexing.

Could anyone, please point a sample table configuration, specifically, around timestamp format, Output timestamp checkbox, Output format from the UI of DB connect / DB inputs.

How to define the format of timestamp when the underlying DB table has timestamp value in epoch time than in a regular date format (of any typical Database).

Thanks.

[pmdba · Accepted solution]

My experience is that you need to make sure that:

• The input is not configured to add its own timestamp automatically

• You use a custom query to select data for the input

• You convert the raw timestamp to a readable date-time string like "July 31, 2013 23:59:00" (in Oracle you would use to_char)

• You place the timestamp column first in your result set

[splunkears]

Thanks. Yes, doing the custom select query with timestamp in the first column of the result worked for me.