dbconnect timestamp

[sbsbb]

I've a DBconnect on a MSSQL

My Timestamp in the DB looks like this : 2013-04-04 15:24:36.7170000

I've defined the folowing
output.timestamp.format = "yyyy-MM-dd HH:mm:ss.SSS"
output.timestamp.parse.format = "yyyy-MM-dd HH:mm:ss.SSS"

The output from Splunk is
1970-01-01 00:59:59.999 !

I've tried to truncate the input to 2013-04-04 15:24:36.717 first, but same result

[Lazarix]

You can also do:

| convert timeformat="%Y/%m/%d" ctime(name of your date column) as NEWDATE

substitute the %Y/%m/%d for whatever time periods you want to show up.

[Lazarix]

The alternative is to define a search macro for it instead.
I've found that there is no global way for Splunk to parse MySQL or MSSQL timestamps

[sbsbb]

ok that will always work, the same for a to_char in sql... but I doesn't want to make that for each date field and for each query...

[sbsbb]

I've found some possibility in oracle : alter session set NLS_DATE_FORMAT='DD-MON-YY'

But I'm not able to use that command in DBquery

[sbsbb]

I've found some possibility in oracle :
alter session set NLS_DATE_FORMAT='DD-MON-YY'

But I'm not able to use that command in DBquery