Yes this bug SPL-90600 has now been fixed in our latest release: http://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/6.1.4#Highlighted_Issues ... View more

The $earliest$ and $latest$ variables are in epoch time, so I just wrote a stored procedure that converts it to DATE and runs the query based on that. SQL: Create Procedure [dbo].[procedureName] @EpochBeginDate INT, @EpochEndDate INT AS BEGIN Set NOCOUNT ON DECLARE @BeginDate DATE; DECLARE @EndDate DATE; IF @EpochBeginDate IS NULL BEGIN --Defaulting to three months ago SELECT @BeginDate = DATEADD(MONTH, -3, GETDATE()); END ELSE BEGIN --adding EpochBeginDate to 01-01-1970 SELECT @BeginDate = DATEADD(s, @EpochBeginDate, '19700101'); END IF @EpochEndDate IS NULL BEGIN --Defaulting to Today SELECT @EndDate = GETDATE(); END ELSE BEGIN --adding EpochEndDate to 01-01-1970 SELECT @EndDate = DATEADD(s, @EpochEndDate, '19700101'); END -- Insert statements for procedure here SELECT FROM WHERE END ... View more

When I configured the lookup, the table I used needed to be "dbo.tablename" (rather than just "tablename"). After changing the lookup to use "dbo.tablename", I stopped getting this error. ... View more