Splunk Search

Custom search by Date on results pulled from DB

aboccia
New Member

Hello Splunk Community,

I am very new to splunk and am currently having a small issue. I have a search query which pulls results from a database, the date field returns an epoch encoded date string which i use splunk to convert to human readable format, the results are shown below:

Query:
| dbquery "ActionDB - Connection 1" "SELECT action_type,activity_date FROM app_activity"|convert timeformat="%D" ctime(activity_date) | rename action_type AS Activity activity_date AS "Activity Date" |fields "Activity Date",Activity

Results:
Activity Date Activity
1 03/27/06 Run
2 03/27/06 Jump Rope
3 03/27/06 None
4 05/10/06 None
5 03/10/06 Eat Apple
6 04/11/06 Run

When i attempt to input a custom search time, it does not seem to work. I have been attempting to find a way to be able to search and return results based on a custom time span checked against the activity date field. I suspect I am having difficulty with this query because these are results gathered from a direct DB query, would I have to create a custom field for this search in order for the splunk system to recognize the date stamps? or is there a way to do this in the search by specifying which DB fields to use to check against the custom search time.

Any idea would be greatly appreciated,

Thank You

0 Karma

sowings
Splunk Employee
Splunk Employee

If you mean that you're using the time range picker (up in the upper right near the search button) to change the time span, at present, DB connect doesn't "play nice" with the time picker.

There are two approaches described in the answers post listed below.

http://answers.splunk.com/answers/75999/splunk-db-connect-dbquery-inline-search-and-time-filtering-n...

0 Karma

aboccia
New Member

Thank you very much for that link, I was able to create the macro and can now customize the search time by the DB date field.

0 Karma
Get Updates on the Splunk Community!

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

[Coming Soon] Splunk Observability Cloud - Enhanced navigation with a modern look and ...

We are excited to introduce our enhanced UI that brings together AppDynamics and Splunk Observability. This is ...