Dashboards & Visualizations

Why does ' datetime ' format not work with the Rising Column value in DB Connect V3?

superhm
Explorer

I collected DB data by selecting it as a ' datetime ' format column, such as SERVERTIME, in DB connect v2 as the Rising Column.
However, in DB Connect v3, it is normally queried in the data preview, but eventually no data is imported from the DB.
Why is this?

My sql query is
SELECT *
FROM "avdb"."dbo"."avvirusalertlog"
WHERE SERVERTIME > ?
ORDER BY SERVERTIME ASC

Please help me.
Thank you.

0 Karma
1 Solution

akocak
Contributor

I had similar issue before, I made it work by converting date to EPOCH in SQL and follow this incremental number from DB connect to continuously index from table.

View solution in original post

0 Karma

akocak
Contributor

I had similar issue before, I made it work by converting date to EPOCH in SQL and follow this incremental number from DB connect to continuously index from table.

0 Karma

yassy
Explorer

Hello Can you tell me the sentences in SQL?

Tks

0 Karma

akocak
Contributor

Which SQL ? Oracle or MSSQL or Informix ? Can you tell me which one ? They all have a different syntax.

0 Karma

superhm
Explorer

MSSQL sentences please for me : )

0 Karma

akocak
Contributor

Assuming we have 3 fields, Datetime, ID and some value, and DBConnect doesn't want work with ID for some reason, then :

SELECT cast(DATEDIFF(s, '1970-01-01 00:00:00.000', Datetime ) as bigint) as MyNewID,
ID,
Datetime,
Some Value
where <some conditions>

then Try MyNewID instead of ID in DB Connect.

0 Karma

jplumsdaine22
Influencer

Nothing there looks wrong. What does your db_inputs.conf look like?

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...