About osherma

osherma · ‎12-01-2013

Thank you for your answer. It is event data, and unfortunately, due to its size (hundreds of GBs), cannot be "dumped" into an event source . I also assume that the queries will take time, but I still wonder how to write queries that work...any ideas?

rafamss · ‎12-13-2013

Hi oshema, Try this: Instead FIELD_DELIMITER = ";" use DELIMS = ";" Instead FIELD_NAMES use FIELDS = "field1","field2","field3" Stop e Start Splunk.

Posts	5
Solutions	0
Karma Given	0
Karma Received	1
Member Since	‎11-14-2013

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Join DBConnect SQL query with other datasets

Troubles with creating a new source type

Re: Join DBConnect SQL query with other datasets

Re: Troubles with creating a new source type