DB Connect MS SQL Datetime

[devicenul1]

Splunk not reading my datetime value correctly:

select top 1 convert(datetime,posting_date) as PostedDate

Result:
PostedDate: 2005-12-08 08:26:00.000

Following the steps in the documentation this should be all I need to do, but it's not working. Instead Splunk is indexing the event based on the date / time of the Splunk server.

I also tried following the workaround suggested in the documentation:
output.timestamp.parse.format = yyyy-mm-dd hh:MM:ss.SSS

and it still doesn't work, just not sure what I'm missing.

Updated inputs.conf

[dbmon-tail://RO_DB/PostedOrders]
host = DBSRVR
index = DBIndex
interval = 2m
output.format = kv
output.timestamp = 1
output.timestamp.column = por_POSTING_DATE
query = SELECT por_POSTING_DATE,por_ORD_KEY,por_POSTING_DATE as PostedDate from table {{WHERE $rising_column$ > ?}}
sourcetype = PostedOrders
tail.rising.column = por_ORD_KEY
table = PostedOrders
disabled = 0
output.timestamp.format = yyyy-mm-dd hh:MM:ss

Updated Props.conf

[PostedOrders]
MAX_DAYS_AGO = 5000
TIME_FORMAT=%s

[linu1988]

no it is not necessary as you rightly said , output.timestamp = 1 then you need the format else all the config is fine and the output.timestamp doesn't affect the input. Just try dump your data into some default index to see if it works.

More than that just check in dbx.log what exactly is happening... Please come back if you see any issue 🙂

[devicenul1]

the posting_date column is in the smalldatetime format without the convert() the data returns a bit differently(result: 2008-05-09 10:30:00) so should my inputs.conf look like this:

output.timestamp=1
output.timestamp.column = PostedDate
output.timestamp.format = yyyy-mm-dd hh:MM:ss
query= select top 10 posting_date as PostedDate from table

Is the timestamp.format of dd/mm/yyy hh:MM:ss in your config because splunk wants it that way? I see you also have an output.timestamp of =0 so is the .format line even necessary?