Archive

Splunk DB Connect 1: Why is my inputs.conf configuration not changing the time format of timestamps (ex: 1355293814.207) for data fetched from MS SQL?

Communicator

In inputs.conf file of local folder, I changed this, but the format is not being applied.

index = default
output.format = csv
output.timestamp = 0
output.timestamp.column = CreateTime
output.timestamp.parse.format = yyyy-MM-dd' 'HH:mm:ss.SSS' 'Z
output.timestamp.format = yyyy-MM-dd' 'HH:mm:ss' 'Z
query = SELECT RequestID,TransactionID,PWMTrxID,CreateTime FROM TRANSACTIONS limit=10
table = TRANSACTIONS
tail.rising.column = CreateTime
0 Karma
1 Solution

Splunk Employee
Splunk Employee

Take a look here
http://answers.splunk.com/answers/71191/db-connect-timestamp-format.html
There are also several other interesting answers which I found when I used Google to search for:
splunk answers output.timestamp.format

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!

View solution in original post

Splunk Employee
Splunk Employee

Take a look here
http://answers.splunk.com/answers/71191/db-connect-timestamp-format.html
There are also several other interesting answers which I found when I used Google to search for:
splunk answers output.timestamp.format

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!

View solution in original post

Splunk Employee
Splunk Employee

thanks rsennett_splunk -- my general advice for this sort of thing is to switch to SQL formatting if SPL formatting isn't working, and vice versa.

DB Connect 2 has some nice GUI options for getting time formatting figured out, that might be a good choice here too.

Communicator

ok but db2 is only support by java8 that y i use db1

0 Karma