Getting Data In

Why My Timestamp didnt work on DB Connect?

justodaniel
Path Finder

We set up an input in DbConnect and it works perfectly in our development environment but when we apply the same input to the production server it is not being able to load the data.

Follow below our query:
select DATEDIFF(SECOND, '1970-01-01', Data_inicio_cadastro) as Timestamp,
*
from vw_SplunkBaseClientes;

in data format parameters we configured yyyy-MM-dd HH:mm:ss but in production we are getting the following error message:
2018-06-08 21:18:03.133 -0300 INFO c.s.dbx.server.task.listeners.JobMetricsListener - action=collect_job_metrics connection=AGLPNHPSQL09-PineOnline jdbc_url=null db_read_time=37 record_read_error_count=5312 status=COMPLETED input_name=PineOnlineBaseCliente batch_size=1000 error_threshold=N/A is_jmx_monitoring=false start_time=2018-06-08_09:18:02 end_time=2018-06-08_09:18:03 duration=396 read_count=5312 write_count=0 filtered_count=0 error_count=5312

0 Karma

Richfez
SplunkTrust
SplunkTrust

You are selecting the number of seconds since Jan 1, 1970 as "Timestamp", why should you need to configure the date format parameters as "yyyy-MM-dd HH:mm:ss"?

Also, obviously make a backup of the production stuff before hand, but did you reconfigure production to match your dev environment, or did you just copy the related configuration files over? Because you can pretty much just do the latter....

0 Karma
Get Updates on the Splunk Community!

What the End of Support for Splunk Add-on Builder Means for You

Hello Splunk Community! We want to share an important update regarding the future of the Splunk Add-on Builder ...

Solve, Learn, Repeat: New Puzzle Channel Now Live

Welcome to the Splunk Puzzle PlaygroundIf you are anything like me, you love to solve problems, and what ...

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...