I have a simple flat data table in splunk enterprise 8.02 that has values in a field called UK_0 for current month quantities and UK_1 for the previous month up to UK_6 for six months ago.  I am trying to replace these field names with the actual month names using an eval on now() to get month names      | eval thismonth=strftime(now(),"%B"), lastmonth = strftime(relative_time(now(),"-1mon"),"%B") |stats Values("Service provider") as "Service Provider" values(part_id) as "Part Number" values(UK_1) as lastmonth values(UK_0) as thismonth by "Part Info"     the above simply replaces the UK_0 with the heading "thismonth" rather than June.  how do i get it to say May and June rather than UK_1 & UK_0 ? ... View more

I have an issue where a field in the database I connect to has quotation characters. Previously I have used Replace function in the sql editor: Replace ("Closure Text", '"', '%') AS "Closure Text", this works for Oracle SQL database. When I come to use the same command for an MS SQL database I get an error: "java.lang.IllegalStateException: Column name conflicted, please set shortnames option to false and retry" The query below works if I give new field names but I really want to use the same field names. SELECT *, isnull(Workgroup, 'Blank') as Workgroup2, Replace (last_action, '"', '%') AS last_action, Replace (Problem, '"', '%') AS Problem FROM "OSMQ"."dbo"."OSMQ_TicketData" where (Ticket_Status='Cancelled'or Ticket_Status='Closed' or Ticket_Status = 'Solved/Not Closed') and (Date_Closed >= CONVERT(DATETIME, CONVERT(DATE, getdate()))-1 and Date_Closed < CONVERT(DATETIME, CONVERT(DATE, getdate()))); Any advice would be greatly appreciated. I am using SPLUNK Enterprise 8.0.3 & DBConnect 3.2.0 ... View more

The SQL editor has the following:- Select srp_ordernum, srp_source, srp_hof_seqno, srp_seqno_in_hand_off, srp_entry_type, srp_entry_type_desc, srp_date, srp_initials, srp_surname, srp_location, srp_extn, srp_text, ROW_NUMBER() OVER (ORDER BY srp_date,srp_ordernum,srp_seqno_in_hand_off,srp_hof_seqno) Sequence_no FROM sword.service_request_progress WHERE srp_date > '01-Aug-2018' ORDER BY srp_date The SQL works in Batch mode, but when i switch to rising column, I get the error java.sql.SQLException: Invalid column index DBX 3.1.3 instructs me to use the Sequence_no in the WHERE , but when i do i get the following error: java.sql.SQLSyntaxErrorException: ORA-00904: "SEQUENCE_NO": invalid identifier ... View more