Why do some queries run fine using DBquery but don't run using DBXquery?

[saikatr]

When I use this:

|dbquery xxx "SELECT to_char(ORDERS.TIMEPLACED, 'hh24') || ':00:00-' || to_char(ORDERS.TIMEPLACED + 1/24, 'hh24') || ':00:00' as RANGE, DECODE(ORDERITEMS.SHIPMODE_ID,10053,'NDD-HOME',10054,'NDD-SYW',10058,'STD-HOME') as SHIPMODE, COUNT(distinct ORDERS.ORDERS_ID) as ORDER_COUNT FROM WCSRT.ORDERS, WCSRT.ORDERITEMS WHERE ORDERS.ORDERS_ID=ORDERITEMS.ORDERS_ID AND ORDERS.STATUS in ('S','C','M') AND trunc(ORDERS.timeplaced)=trunc(sysdate) AND to_char(WCSRT.ORDERS.TIMEPLACED, 'hh24')<=24 AND to_char(ORDERS.TIMEPLACED, 'hh24') NOT IN (select to_char(sysdate, 'hh24') from dual) AND ORDERITEMS.SHIPMODE_ID in (10053,10054,10058) GROUP BY to_char(ORDERS.TIMEPLACED, 'hh24') || ':00:00-' || to_char(ORDERS.TIMEPLACED + 1/24, 'hh24') || ':00:00', ORDERITEMS.SHIPMODE_ID ORDER BY RANGE" 

I get valid results.

But when i try this:

|dbxquery coonnection=xxx  query="SELECT to_char(ORDERS.TIMEPLACED, 'hh24') || ':00:00-' || to_char(ORDERS.TIMEPLACED + 1/24, 'hh24') || ':00:00' as RANGE, DECODE(ORDERITEMS.SHIPMODE_ID,10053,'NDD-HOME',10054,'NDD-SYW',10058,'STD-HOME') as SHIPMODE, COUNT(distinct ORDERS.ORDERS_ID) as ORDER_COUNT FROM WCSRT.ORDERS, WCSRT.ORDERITEMS WHERE ORDERS.ORDERS_ID=ORDERITEMS.ORDERS_ID AND ORDERS.STATUS in ('S','C','M') AND trunc(ORDERS.timeplaced)=trunc(sysdate) AND to_char(WCSRT.ORDERS.TIMEPLACED, 'hh24')<=24 AND to_char(ORDERS.TIMEPLACED, 'hh24') NOT IN (select to_char(sysdate, 'hh24') from dual) AND ORDERITEMS.SHIPMODE_ID in (10053,10054,10058) GROUP BY to_char(ORDERS.TIMEPLACED, 'hh24') || ':00:00-' || to_char(ORDERS.TIMEPLACED + 1/24, 'hh24') || ':00:00', ORDERITEMS.SHIPMODE_ID ORDER BY RANGE".

I get 'no results found'.

Can someone explain why DBXquery does not work as smoothly as DBQuery? How do I convert my current DBQueries to work with DBXQuery as well?

[woodcock]

You need to add this:

shortnames=t

[saikatr]

I have tried shortnames=t, shortnames=true.

Its a hit and miss with this. Some queries work well, but some simply refuse to run with DBXquery. Any idea why? In my experience DBXquery simply can't process the more complex queries.

[jcoates_splunk]

Sounds like you should disable query wrapping:
* http://docs.splunk.com/Documentation/DBX/2.3.0/DeployDBX/SQLtipsandtricks#Use_inline_views_.28query_...
* http://docs.splunk.com/Documentation/DBX/2.3.0/DeployDBX/Createandmanagedatabaseinputs
* http://docs.splunk.com/Documentation/DBX/2.3.0/DeployDBX/Troubleshooting#Database_inputs_or_lookups_...
* http://docs.splunk.com/Documentation/DBX/2.3.0/DeployDBX/Commands#dbxquery

Also, the hard-coded limit was removed in version 2.2.0.

[woodcock]

It was not really removed but it did get modified to be user-configurable (with a very small default). This is indeed a welcome improvement.

[woodcock]

V2 also is hardcoded with a VERY small arbitrary row limit (50K or something) which does not exist in V1.

[saikatr]

I see. Would you know how Splunk's customers are taking to Splunk DBConnect 2?

If Splunk wants to ultimately replace DBConnect 1 with DBConnect 2, should they not ensure that it is capable of at least matching up to DBConnect 1, if not improving on it?

[woodcock]

Everyone is editing the file with the limit, which is not supported, but has not (yet) been an issue getting support.