Hi Support, So currently we are trying to execute a DB query, however, you have added a select * from statement to our query. After the upgrade to version Splunk 6.4.1 Windows X64, we noticed this change to our DB Connect 2 Query we are trying to run: declare @dt datetime select @dt = dateadd(SECOND, -300, getdate()) SELECT OrderID, UserID, ConditionStateID, LogicalOperatorID, OC_ActivationTime, OC_StartTime, OC_EndTime, OC_ExpirationDate, OC_IsActive, OC_CreationDate, OC_DmlDate, OC_DmlUserID FROM UBER.dbo.OrderCondition where OC_CreationDate > @dt Invalid Query message: External search command 'dbxquery' returned error code 1. Script output = "RuntimeError: Failed to run query: "SELECT * FROM (declare @dt datetime select @dt = dateadd(SECOND, -300, getdate()) SELECT OrderID, UserID, ConditionStateID, LogicalOperatorID, OC_ActivationTime, OC_StartTime, OC_EndTime, OC_ExpirationDate, OC_IsActive, OC_CreationDate, OC_DmlDate, OC_DmlUserID FROM UBER.dbo.OrderCondition where OC_CreationDate > @dt) t", caused by: AvroRemoteException(u"com.sybase.jdbc4.jdbc.SybSQLException: Incorrect syntax near the keyword 'declare'.\n",). " This is happening for all of our DB input queries now - can you kindly advise? Jacks ... View more

Hi, I would like to sort my bar chart's by the following sequence, (Intensive, Intermediate, Minimal, Moderate). However it is currently being sorted alphabetically (Intensive, Intermediate, Minimal, Moderate.) Below is my current search function: index="sdp" Level !="Not Assigned" Urgency="*" | chart count over Level by Urgency | eval Level=if(Level="Intensive", "1. Intensive", if(Level="Intermediate","2. Intermediate", if(Level="Moderate","3. Moderate", if(Level="Minimal", "4. Minimal" ... View more

Hi, So currently I am pulling a report with all tickets that have been created this year. For the Ticket Resolution Time, I am trying to obtain how long it takes for a ticket to go from an open state to a "Request Status = Resolved or Closed" state. I want to break down all of these resolved & closed tickets based on their complexity to give me an average resolution time based on the 4 complexities (Intensive, intermediate, moderate, and minimal.) This can be 4 separate single value displays. Currently I am stuck with the following search: index=sdp Department="*" "Request Status"=Closed OR "Request Status"=Resolved Level="*" | rename Level as Complexity | eval _time=strptime('Start Time',"%Y-%m-%dT%H:%M:%S.%3N-%z") | timechart span=1d count by "Complexity" ... View more

Hi, I am trying to create a stacked bar graph, using 2 fields. First field is Level, second field is Urgency. I want to sort the columns based on Level, and displaying the number of different Urgency in the stacked column. See below, the long column would show 2 critical items, 1 high, and 1 medium items, for a total of 4 items. Level Urgency Long Critical Long Critical Long High Long Medium Medium High Medium Low Medium Low Medium Low ... View more