Splunk Search

Is there any way to get _time with a dbquery for a data model?

willial
Communicator

I'm trying to get all of the Pivot features to work, but I can't seem to get a _time extracted from the datetime field in the database.

0 Karma

araitz
Splunk Employee
Splunk Employee

I don't believe that pivot/datamodel with dbquery is supported. If you help us understand the use case better, that would be great.

0 Karma

araitz
Splunk Employee
Splunk Employee

Thanks for the explanation. The workaround is to use dbinput to index the data in Splunk, then build a data model on top of the indexed data.

0 Karma

devicenul1
Path Finder

We were evaluating the DB Connect app with the data models to help build a self-service business intelligence platform. But there were too many problems with the implementation. I believe the DB Connect documentation says that if the field from your query is in a date / time format that is all you need to do. But we couldn't get that to work so we ran into similar problems your running into. Changes were another concern of ours as the db-mon tail thing wouldn't go back to import data that changed unless the rising column changes.

0 Karma

willial
Communicator

Basically, I have a database that I'm accessing with DB Connect (via |dbquery). I can set the data model up pretty well as a root search and extract all of the fields with eval expressions.

This works pretty well.

The problem is that I can't get access to the line and area graphs, because those are evidently reliant on a real event-based Splunk _time field. Everything else works alright.

0 Karma

devicenul1
Path Finder

Not sure of the specifics of your case but you can check my question that seems to be similar. Long story short, we were unable to get it to work in my scenario. The inputs.conf and props.conf in my question was updated to portray the information linu1988 was trying to express.

http://answers.splunk.com/answers/135908/db-connect-ms-sql-datetime

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...