one cause is probably because you have the data in your log with an automated extraction at read (default behavior) with host=OptionalProperties try a search like index=msad "host=OptionalProperties" to confirm. ... View more

You probably need dbconnect on your sh if you need it ( by example to use one of the tool provided like direct query ) ... View more

Hello, to get data collected by your search head, you have to configure it has a heavy Forwarder end load balance incomming data (use apropriate stanza) to balance to your indexers. my tip : If you have a lot of dbconnect[2] queries, you'd better have to configure the db connect[2] on a dedicated heavyforwarder (with web ui for convenience) ... View more

I see sometimes the same kind of behaviour and same kind of solution. To complement @imanpoerir suggestion [SOURCETYPE] MAX_TIME_STAMP_LOOKAHEAD=0 TIME_PREFIX=dt_created=" just because your time start 0 character after your TimePrefix. beware to have time in an manageable order for splunk (and adjust your sourcetype time recognition accordingly). ( http://docs.splunk.com/Documentation/Splunk/latest/Admin/propsconf ) ... View more

Thanghals, Does your db input definitions are in dbconnect app or the app where definitions are, share objects globally ? You may try to solve this issue by moving inputs definition inside dbconnect2 app. ... View more

It looks like an overflow of the data . if it is the case : The format in MSSQL of time is not like unix timestamps (see below). You may try convert (bigint) and divide in the select query by 1000 the values to get seconds for the "Long" Part (left side of the comma|dot ) and the milliseconds will be dropped out. Remark form https://technet.microsoft.com/en-us/library/aa260631(v=sql.80).aspx The Transact-SQL timestamp data type is not the same as the timestamp data type defined in the SQL-92 standard. The SQL-92 timestamp data type is equivalent to the Transact-SQL datetime data type. A future release of Microsoft® SQL Server™ may modify the behavior of the Transact-SQL timestamp data type to align it with the behavior defined in the standard. At that time, the current timestamp data type will be replaced with a rowversion ... View more