Splunk Enterprise

db query not working

pratapa
Explorer

Following db query not working.

| dbquery wmsewprd select REC_TYPE, CODE_TYPE, CODE_DESC, SHORT_DESC, USER_ID, To_Char(mod_date_time,'dd/mm/yyyy hh:mi:ss AM') AS MOD_DATE_TIME from SYS_CODE_TYPE where rec_type = 'C' and code_type = 'AWO'
and (sysdate - mod_date_time)*24*60 < 60"

 

Getting following error.

command="dbquery", A database error occurred: ORA-00942: table or view does not exist

 

But the table SYS_CODE_TYPE does exist.

 

When we run the following query it is returning events.

dbquery wmsewprd "select REC_TYPE, CODE_TYPE, CODE_DESC, SHORT_DESC, USER_ID from SYS_CODE_TYPE"

What could be the problem

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust
Have you checked the logs to see if more detail is provided? Look at splunk_app_db_connect_dbx_log.* and splunk_app_db_connect_server.log.
Also, see what is reported in Oracle's logs.
---
If this reply helps you, an upvote would be appreciated.
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!