DBConnect dobbel quotes in key value pair

[lyngstad]

Hello

I have a DBConnect query that gets data from a database and then send it to a Splunk index. Below are the query and also how it looks in Splunk. The data is being indexed as key=value pair with dobbel quotes around "value". I have plenty of other data that is not using DBConnect and they dont have dobbel quotes around value.  

Maybe the quotes is there because im using DBConnect?

Is it possible to index data from DBConnect without adding the quotes?

When i try to searc the data in Splunk i just dont get any data. I think it may have to do with the dobbel quotes? I'm not sure.

Here are the search string. The air_temp is defined in the Climate datamodel. The TA(air temperature) in the data is defined in props.conf with the right sourcetype TU_CLM_Time.

| tstats avg(Climate.air_temp) as air_temp from datamodel="Climate" where sourcetype="TU_CLM_Time" host=TU_CLM_1 by host _time span=60m ```Fetching relevant fields from CLM sourcetype in CLM datamodel.```

[victor_menezes]

Hi @lyngstad ,

Based in your search results screenshot, you get the values from the by clause but lack the calculation of air temp, so I guess the trick is to format the datamodel to be measured (so yes, it may be related to some double quotes around the values).

Can you try this then? Trying to get it via "values" so we can later convert to number and remove the quotes, which will allow average metric.

| tstats values(Climate.air_temp) as air_temp_raw from datamodel="Climate" where sourcetype="TU_CLM_Time" host=TU_CLM_1 by host _time span=60m
| eval air_temp_numeric = tonumber(trim(air_temp_raw, "\""))
| stats avg(air_temp_numeric) as air_temp by host _time

[lyngstad]

Hi

Thanks for answering.

I tried the search you provided with no luck.

[victor_menezes]

Okay, in this case, please share the search that renders the datamodel. Perhaps you can do the replace there to make sure there are no double quotes returned on Climate.air_temp field.

[lyngstad]

Okey, so i dont now exactly where the search is. I have the datamodel.