Hello, We are using DB Connect to collect logs from Oracle databases. We are using a rising mode input which requires the database statement be written in a way where column used for checkpointing is compared against a "?". Splunk DB Connect fills in the "?" with the check point value. Occasionally we will get "ORA-01843: Not a Valid Month errors" on inputs. The error itself is understood.* The question is, how do we rewrite the query to avoid this, when Splunk/DB Connect is handling how the "?" in the query is replaced? Here is an example query: SELECT ACTION_NAME, CAST((EVENT_TIMESTAMP at TIME zone America/New_York) AS TIMESTAMP) extended_timestamp_est FROM AUDSYS.UNIFIED_AUDIT_TRAIL WHERE event_timestamp > ? ORDER BY EVENT_TIMESTAMP asc; How can we format the timestamp in the "?" in a way that the database understands and meets the DB Connect rising input requirement? Thank you! *(Our understanding is that it means that the timestamp/time format in the query is not understood by the database. The fact that it happens only occasionally means there is probably some offending row within the results set.)
... View more
