Splunk Search

Custom search by Date on results pulled from DB

New Member

Hello Splunk Community,

I am very new to splunk and am currently having a small issue. I have a search query which pulls results from a database, the date field returns an epoch encoded date string which i use splunk to convert to human readable format, the results are shown below:

| dbquery "ActionDB - Connection 1" "SELECT action_type,activity_date FROM app_activity"|convert timeformat="%D" ctime(activity_date) | rename action_type AS Activity activity_date AS "Activity Date" |fields "Activity Date",Activity

Activity Date Activity
1 03/27/06 Run
2 03/27/06 Jump Rope
3 03/27/06 None
4 05/10/06 None
5 03/10/06 Eat Apple
6 04/11/06 Run

When i attempt to input a custom search time, it does not seem to work. I have been attempting to find a way to be able to search and return results based on a custom time span checked against the activity date field. I suspect I am having difficulty with this query because these are results gathered from a direct DB query, would I have to create a custom field for this search in order for the splunk system to recognize the date stamps? or is there a way to do this in the search by specifying which DB fields to use to check against the custom search time.

Any idea would be greatly appreciated,

Thank You

0 Karma

Splunk Employee
Splunk Employee

If you mean that you're using the time range picker (up in the upper right near the search button) to change the time span, at present, DB connect doesn't "play nice" with the time picker.

There are two approaches described in the answers post listed below.


0 Karma

New Member

Thank you very much for that link, I was able to create the macro and can now customize the search time by the DB date field.

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...