Splunk Search

EPOCH CONVERSION IN ORACLE QUERY

harshavrath
Contributor

Hi,

I need to convert the EPOCH Time using Oracle Query,by using DB Query i have figured out using the below query it can be done

|dbquery DB_NAME limit=10 "Select * from Table_NM" |fieldformat NEW_CREATED_DT=strftime(CREATED_DT,"%d-%m-%y %H:%M:%S")

But i want the query that can be used in Oracle.

Any Help is Appreciated,

Thanks.

Tags (3)
0 Karma
1 Solution

harshavrath
Contributor

I found the answer myself just to_char(date_attribute,'YYYY-MM-DD HH24:MI:SS')date_attribute will work no need of trying to convert it by multiplying & dividing the current time with 1970.

View solution in original post

0 Karma

harshavrath
Contributor

I found the answer myself just to_char(date_attribute,'YYYY-MM-DD HH24:MI:SS')date_attribute will work no need of trying to convert it by multiplying & dividing the current time with 1970.

View solution in original post

0 Karma

linu1988
Champion

yes because ,thats no longer a date field. but a good trick

harshavrath
Contributor

I will be indexing my DB table under DB Inputs.Using Input_Type=tail.

0 Karma

harshavrath
Contributor

Sorry linu i couldn't understand you, can you be a bit more specific.

0 Karma

linu1988
Champion

if it is the summary index you can use as it is in a savedsearch. If you are trying to use dbmon then the sql query will index and while tabulating or creating dashboard you have to do the time conversion again.

0 Karma

harshavrath
Contributor

I need the query as i would be using it to input a table & index into Splunk.

0 Karma

linu1988
Champion

oracle is not doing the time conversion its splunk which is converting the date field. you need to do the above to get the human readable format.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!