Splunk Search

Is there any way to get _time with a dbquery for a data model?

willial
Communicator

I'm trying to get all of the Pivot features to work, but I can't seem to get a _time extracted from the datetime field in the database.

0 Karma

araitz
Splunk Employee
Splunk Employee

I don't believe that pivot/datamodel with dbquery is supported. If you help us understand the use case better, that would be great.

0 Karma

araitz
Splunk Employee
Splunk Employee

Thanks for the explanation. The workaround is to use dbinput to index the data in Splunk, then build a data model on top of the indexed data.

0 Karma

devicenul1
Path Finder

We were evaluating the DB Connect app with the data models to help build a self-service business intelligence platform. But there were too many problems with the implementation. I believe the DB Connect documentation says that if the field from your query is in a date / time format that is all you need to do. But we couldn't get that to work so we ran into similar problems your running into. Changes were another concern of ours as the db-mon tail thing wouldn't go back to import data that changed unless the rising column changes.

0 Karma

willial
Communicator

Basically, I have a database that I'm accessing with DB Connect (via |dbquery). I can set the data model up pretty well as a root search and extract all of the fields with eval expressions.

This works pretty well.

The problem is that I can't get access to the line and area graphs, because those are evidently reliant on a real event-based Splunk _time field. Everything else works alright.

0 Karma

devicenul1
Path Finder

Not sure of the specifics of your case but you can check my question that seems to be similar. Long story short, we were unable to get it to work in my scenario. The inputs.conf and props.conf in my question was updated to portray the information linu1988 was trying to express.

http://answers.splunk.com/answers/135908/db-connect-ms-sql-datetime

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...