Getting Data In

dbconnect ms sql timestamp error

sduchene_splunk
Splunk Employee
Splunk Employee

Hello, Question + answers here :
We were using dbconnect 2 for a MS sql query. the column used for the timestamp was giving us an error BIGINT.
(you can see it by typing index=_internal sourcetype=dbx2 error )
The trick is to convert the MS SQL epoch time, wich is in millinsecond, to a linux epoch time, in second, so that splunk can understand the time.
How do we do this ? answer below. hope it's useful for you

0 Karma
1 Solution

sduchene_splunk
Splunk Employee
Splunk Employee

the idea is to convert the epoch time. Good thing to know : epoch time on win!=epochtime on linux....
the sql command that did the trick is : dateadd
and also divide by 1000 to get the epoch time in second instead of ms

dateadd(second, mysqlfield/1000,'19700101')

View solution in original post

0 Karma

sduchene_splunk
Splunk Employee
Splunk Employee

the idea is to convert the epoch time. Good thing to know : epoch time on win!=epochtime on linux....
the sql command that did the trick is : dateadd
and also divide by 1000 to get the epoch time in second instead of ms

dateadd(second, mysqlfield/1000,'19700101')

View solution in original post

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!