Knowledge Management

Splunk DB Connect Bug

linu1988
Champion

Good Morning/Afternoon to all!!

I have a query regarding the dataset returned by |dbquery. If the Database has a time field while viewing the result it shows wrong value which it converts to some other format like "1370428834.360"
for the date "21/06/13 15:41:24". I can apply in the search tab to convert it into proper timestamp.

Now the question is how can i do it on the dashboard itself as the column names will not be the same for every table..

Thanks for your attention.

0 Karma

pmdba
Builder

If a datetime column is returned as part of your query you must convert it to a text datatype, otherwise Splunk will display it as a number. For example, in Oracle, use the "to_char" function in the query to convert to the text format you want:

select to_char(datetime_field_name,'DD/MM/YY HH24:MI:SS') "display_col_name" from table_name;

This would return the value of the datetime_field_name column in the table_name table in the format you listed in your original question.

0 Karma

pmdba
Builder

I would suggest that different databases may not store datetime information in the same format. Splunk is primarily designed to index and search text, not other datatypes. Changing your query to format the results in a way Splunk can read it correctly is not "changing your database," since the underlying data has not changed at all.

0 Karma

linu1988
Champion

But this is not a solution!! Who will change their DB just to show the content in Splunk? Date Time should be recognized automatically and shown as it is rather than epoch format. Btw Thank you for your time.

0 Karma
Get Updates on the Splunk Community!

Monitoring Postgres with OpenTelemetry

Behind every business-critical application, you’ll find databases. These behind-the-scenes stores power ...

Mastering Synthetic Browser Testing: Pro Tips to Keep Your Web App Running Smoothly

To start, if you're new to synthetic monitoring, I recommend exploring this synthetic monitoring overview. In ...

Splunk Edge Processor | Popular Use Cases to Get Started with Edge Processor

Splunk Edge Processor offers more efficient, flexible data transformation – helping you reduce noise, control ...