This answer is a little late for @mas Here is my GUI hack. Put the following in the DBConnect query window. if 1=2 select getdate() as EventDateTime Exec GetDataForSplunk ? if 1=2 select * from Bogus where EventDateTime > 'bogus' order by EventDateTime Explanation: Assume EventDateTime is the column you want to use as a rising column from your results of stored procedure GetDataForSplunk. Setting the query if 1=2 select getdate() as EventDateTime allows the column EventDateTime to show up in your rising column and/or Timestamp pick list. DBConnect generates its picklist from a FMTONLY sql command on the query it sees and it pulls the column names from the first result set. You can have multiple column names if you want to have different columns used for the rising column and timestamp. Just add it after if 1=2 . Example.... if 1=2 select getdate() as EventDateTime, getdate() as TimeStampColumnName . THIS ONLY WORKS IF THE FIELD NAMES ARE IN THE PROPER COLUMN ORDER AS THEY WOULD APPEAR IN THE SQL RESULT OF THE STORED PROCEDURES RESULT SET. IF IT IS NOT, YOU HAVE TO PUT IN MORE BOGUS COLUMNS IN FRONT OF IT. If EventDateTime is 4th and TimeStampColumnName is 6th then use -> if 1=2 select 1 as Bogus1, 1 as Bogus2, 1 as Bogus3, getdate() as EventDateTime, 1 as Bogus5, getdate() as TimeStampColumnName. The next part is where you execute your stored procedure adding ? as an input that your stored procedure needs to expect for your rising column. The last if 1=2 is to get around the check for making sure you you have an "order by" clause in your query. As jplumsdaine22 indicated, if the stored procedure changes and it affects the placement number of the fields you chose, you will need to fix your first if 1=2 query to match that order. You can't look at the column order that Splunk displays the results in (alphabetically) to know the column order. Bogus used above can be whatever you want. ... View more