Splunk Enterprise

db query not working

pratapa
Explorer

Following db query not working.

| dbquery wmsewprd select REC_TYPE, CODE_TYPE, CODE_DESC, SHORT_DESC, USER_ID, To_Char(mod_date_time,'dd/mm/yyyy hh:mi:ss AM') AS MOD_DATE_TIME from SYS_CODE_TYPE where rec_type = 'C' and code_type = 'AWO'
and (sysdate - mod_date_time)*24*60 < 60"

 

Getting following error.

command="dbquery", A database error occurred: ORA-00942: table or view does not exist

 

But the table SYS_CODE_TYPE does exist.

 

When we run the following query it is returning events.

dbquery wmsewprd "select REC_TYPE, CODE_TYPE, CODE_DESC, SHORT_DESC, USER_ID from SYS_CODE_TYPE"

What could be the problem

0 Karma

richgalloway
SplunkTrust
SplunkTrust
Have you checked the logs to see if more detail is provided? Look at splunk_app_db_connect_dbx_log.* and splunk_app_db_connect_server.log.
Also, see what is reported in Oracle's logs.
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...