in v2.2 you can also add the argument output=csv which will omit the _raw and _time fields. |dbxquery connection="whatever" query="SELECT%20id,name%20FROM%20table" output=csv shortnames=true | dedup name ... View more

It’s still kind of weird Splunk mentions this is done to prevent configuration errors, but the only workaround now is to go to another input option which does NOT check on validation 😉 However, the workaround from dsuryaavinash (thnx!) to this suggestion is a valid one: create in the regular DBConnect V2 interface the query and settings and use a dummy query like ‘select 1 from DUAL’ and after saving edit it in the data inputs/DB Connect input service. (but again, this does not validate if the query is correct). Everyone I speak using DBConnect can't understand this logic. ... View more