All Apps and Add-ons

Splunk DBConnect App - not reading timestamp column value correctly

splunkears
Path Finder

This is related to Splunk DB Connect App. While configuring a table with Timestamp column, the timestamp is not getting into effect at the time of indexing, by Splunk.

For example, the table being indexed has say, timestamp value in year, say 2008. After indexing the table, any time charts created using this data is showing timestamp of current time than timestamp in 2008. All all events indexed for this table, fall (wrongly) in the same day & time of indexing.

Could anyone, please point a sample table configuration, specifically, around timestamp format, Output timestamp checkbox, Output format from the UI of DB connect / DB inputs.

How to define the format of timestamp when the underlying DB table has timestamp value in epoch time than in a regular date format (of any typical Database).

Thanks.

0 Karma
1 Solution

pmdba
Builder

My experience is that you need to make sure that:

  • The input is not configured to add its own timestamp automatically

  • You use a custom query to select data for the input

  • You convert the raw timestamp to a readable date-time string like "July 31, 2013 23:59:00" (in Oracle you would use to_char)

  • You place the timestamp column first in your result set

View solution in original post

pmdba
Builder

My experience is that you need to make sure that:

  • The input is not configured to add its own timestamp automatically

  • You use a custom query to select data for the input

  • You convert the raw timestamp to a readable date-time string like "July 31, 2013 23:59:00" (in Oracle you would use to_char)

  • You place the timestamp column first in your result set

splunkears
Path Finder

Thanks. Yes, doing the custom select query with timestamp in the first column of the result worked for me.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...