Splunk DB Connect: Why am I getting an error trying to select a column for my dbmon-tail input?

[sim_tcr]

Hello,

I am trying to setup a tailing query using Splunk DB Connect app.

My query is:

select * from table WHERE CREATED_DT > TO_DATE('03/20/2015 05:11:51','mm/dd/yyyy hh24:mi:ss') {{AND $rising_column$ > ?}} 

and it works.

Now i am trying to change it to selected column only as below and while trying to save the database input, I get an error.

select APPLICATION_NM from  table WHERE CREATED_DT > TO_DATE('03/20/2015 05:11:51','mm/dd/yyyy hh24:mi:ss') {{AND $rising_column$ > ?}}

Error is:

03-20-2015 06:59:50.313 -0400 ERROR AdminManagerExternal - Received malformed XML from external handler:\nFailed to validate: com.splunk.config.SplunkConfigurationException: Error validating dbmonTail for monitor=dbmon-tail://XXX/XXX-date: Unrecognized or ambiguous rising column name [CREATED_DT] is used. For Oracle database, qualified column name cannot be used, use " ()" instead.\n with query = select APPLICATION_NM from XXXXXXXX WHERE CREATED_DT > TO_DATE('03/20/2015 05:11:51','mm/dd/yyyy hh24:mi:ss') \nfalse<class 'spp.java.bridge.JavaBridgeError'>Command com.splunk.dbx.monitor.DatabaseMonitorValidator returned status code 17Traceback (most recent call last):\n  
File "/Splunk/splunk/lib/python2.7/site-packages/splunk/admin.py", line 70, in init\n    hand.execute(info)\n  
File "/Splunk/splunk/lib/python2.7/site-packages/splunk/admin.py", line 528, in execute\n    if self.requestedAction == ACTION_EDIT:     self.handleEdit(confInfo)\n  
File "/Splunk/splunk/etc/apps/dbx/bin/spp/config.py", line 238, in handleEdit\n    self.handleModification("edit", output)\n  
File "/Splunk/splunk/etc/apps/dbx/bin/spp/config.py", line 218, in handleModification\n    id, props = self.process_modification(id, props, type=type, output=output)\n  
File "/Splunk/splunk/etc/apps/dbx/bin/rest_handler_dbmon.py", line 95, in process_modification\n    self.validateConfig(stanza, props)\n  
File "/Splunk/splunk/etc/apps/dbx/bin/rest_handler_dbmon.py", line 126, in validateConfig\n    executeBridgeCommand("com.splunk.dbx.monitor.DatabaseMonitorValidator", args, checkStatus=True)\n  
File "/Splunk/splunk/etc/apps/dbx/bin/spp/java/bridge.py", line 182, in executeBridgeCommand\n    raise JavaBridgeError("Command %s returned status code %s" % (cmd, ret))\nJavaBridgeError: Command com.splunk.dbx.monitor.DatabaseMonitorValidator returned status code 17\n\n

Can any one assist?

[mzorzi]

try with:

{{ WHERE CREATED_DT > TO_DATE('03/20/2015 05:11:51','mm/dd/yyyy hh24:mi:ss') AND $rising_column$ > ?}}

[sim_tcr]

it work only if i do select *. Not if I do SELECT somecolumn

[sim_tcr]

one more observation.
i could save select CREATED_DT from table WHERE CREATED_DT > TO_DATE('03/20/2015 05:11:51','mm/dd/yyyy hh24:mi:ss') {{AND $rising_column$ > ?}}

That is whatever my tailing column i can select that coumn only. Or i have to do select *