Knowledge Management

Column names with Oracle and DB Connect

girtsgr
Explorer

I have a DB Connect input: SELECT EVENT_ID, EVENT_TYPE, ... FROM table WHERE EVENT_ID > ? ORDER BY EVENT_ID ASC.
The fields in the result all come with a column name, eg:
EVENT_ID="225894621", EVENT_TYPE="QUERY_BILLS",...
EVENT_ID="225894620", EVENT_TYPE="CONN_SERVICE",... etc.

It seems to me that it's an unnecessary overhead. Can I get rid of the column names?

Tags (1)
0 Karma
1 Solution

tiagofbmm
Influencer

No, DBConnect method of collection is to create a KV pair out of each field, no way around that

View solution in original post

0 Karma

tiagofbmm
Influencer

No, DBConnect method of collection is to create a KV pair out of each field, no way around that

0 Karma

girtsgr
Explorer

Too bad. What's the best way to get usefull fields out of the results - use field extraction or something else?

0 Karma

tiagofbmm
Influencer

Assign the events to a sourcetype which has KV_MODE=auto to get the fields and values automatically extracted. If not, use REGEX to get them on the sourcetype level too

0 Karma

girtsgr
Explorer

Great, will do that, thank you!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...