Is there any way to get _time with a dbquery for a data model?

[willial]

I'm trying to get all of the Pivot features to work, but I can't seem to get a _time extracted from the datetime field in the database.

[araitz]

I don't believe that pivot/datamodel with dbquery is supported. If you help us understand the use case better, that would be great.

[araitz]

Thanks for the explanation. The workaround is to use dbinput to index the data in Splunk, then build a data model on top of the indexed data.

[devicenul1]

We were evaluating the DB Connect app with the data models to help build a self-service business intelligence platform. But there were too many problems with the implementation. I believe the DB Connect documentation says that if the field from your query is in a date / time format that is all you need to do. But we couldn't get that to work so we ran into similar problems your running into. Changes were another concern of ours as the db-mon tail thing wouldn't go back to import data that changed unless the rising column changes.

[willial]

Basically, I have a database that I'm accessing with DB Connect (via |dbquery). I can set the data model up pretty well as a root search and extract all of the fields with eval expressions.

This works pretty well.

The problem is that I can't get access to the line and area graphs, because those are evidently reliant on a real event-based Splunk _time field. Everything else works alright.

[devicenul1]

Not sure of the specifics of your case but you can check my question that seems to be similar. Long story short, we were unable to get it to work in my scenario. The inputs.conf and props.conf in my question was updated to portray the information linu1988 was trying to express.

http://answers.splunk.com/answers/135908/db-connect-ms-sql-datetime