Archive

Field names from same DB Inputs on different indexers have different cases...

dlovett
Path Finder

I have two indexers: one legacy where DB Connect 1.0.x was installed and updated as releases come out and another that is brand new with DB Connect 1.1.1 as the initial instal. The field names on the legacy indexer are all caps where the field names on new indexer are all lowercase.

Both use DB Inputs with same settings and SQL except for the name of the index;

There are no props or transforms used;

I couldn't find any difference in configurations on both indexers that are obvious; ie they're pretty simple setups;

Anybody else experiencing something like this with DB Connect DB inputs?

0 Karma

mchang_splunk
Splunk Employee
Splunk Employee

This issue has been resolved in 1.1.2:
Table column names were unexpectedly converted to lower case. (DBX-347)
Please refer to this link:
http://docs.splunk.com/Documentation/DBX/1.1.2/DeployDBX/Releasenotes#Fixed_problems

0 Karma

jbrodsky_splunk
Splunk Employee
Splunk Employee

There is an internal case on this, and it is a known issue. If you are a splunk customer under support, please open a case and reference JIRA DBX-340 so that we may track the fix and let you know when we have resolved it.

aelliott
Motivator

Yeah and it's new to DB Connect 1.1.1 I would think they would want to fix this sometime soon or update their documentation.

0 Karma

dlovett
Path Finder

I always assumed the field names matched the column names in the DB. ie All of the column names in our Oracle tables are uppercase and the field names on the legacy indexer all show the field names in uppercase.

This is quite the scenario :^)

0 Karma

aelliott
Motivator

Yep http://answers.splunk.com/answers/109879/case-sensitive-columns-from-sql

One workaround would be to change all your fields to lower case, but I'm not sure these should be case sensitive to begin with (or should at least match the case of the fields returned)

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!