how can I query against a time range if i have renamed datetime to _time?

[guilmxm]

Hi,
Thanks you so much for this very great application that opens Splunk to many information system reality!
This App is definitively a must and real well done! i would advise it to anyone.

I am currently developing front ends for my client using Splunk and dbquery to directly works with various data from our databases, still i have an issue with timestamp and i would prefer not to have to locally index these data.

I use the command "rename" to change the datatime column field into "_time" field which works fine to generate timecharts (using timechart command), but this does not allow to filter the search through any timerange or timepicker...this is quite strange as in raw data Splunk seems to recognize the timestamp translated from db format...

Please Would know you do a way to achieve this using dbquery ? Thank you very much for your answer !

[ziegfried · Accepted solution]

See http://splunk-base.splunk.com/answers/75999/splunk-db-connect-dbquery-inline-search-and-time-filteri...

[royimad]

I there any simple XML down streaming time range picker values to the search by dbquery?