Hi Team, I was trying out this exercise, which would come handy when we hook on splunk to our production DB's. -> Created a full dump db-input on a table, All the rows from that table were indexed in splunk. -> Dropped a column from the table on which db-input was created, and then added two rows to that table, did not see those two rows coming in, nor did the logs in dbx.log give any errors/information -> recreated the column back, and added two more rows, made the table similar to how it was when the db input was created, but did not see those 2 rows from the 2nd scenario or 2 rows in this scenario getting indexed in splunk. Did not see any information related to this in the logs as well. Can you please help me here to find out if there is a way of carrying out this exercise successfully. Thanks in advance. ... View more

Hi, I am trying to index a date column of my table which is stored in epoch format. No matter what i do, when i try to view the index, it gives me wrong value. Ex : if the event had occured at 14:22 on Aug 8th, the time column gives me the current time(i.e sysdate) and the event column gives me "1970-01-01 05:29:59" as the standard value, no matter what conversions i do in my SQL query . the output timefomat i have set to : yyyy-MM-dd'T'HH:mm:ss.SSSZ My DB is in PDT timezone. Different flavors of SQL query used : SELECT * FROM (SELECT TO_CHAR (NEW_TIME (epoch_to_date (a.created), 'GMT', 'PDT'),'YYYY-MM-DD HH24:MI:SS') create_date,a.cobrand_id, a.cache_item_id, a.sum_info_id, a.server_type,a.server_stats_id FROM temp_sg_server_stats a) --Raising column = create_date SELECT * FROM (SELECT TO_CHAR(epoch_to_date_for_tz (a.created),'YYYY-MM-DD HH24:MI:SS') createdate,a.cobrand_id, a.cache_item_id, a.sum_info_id, a.server_type, a.server_stats_id FROM temp_sg_server_stats a) {{WHERE $rising_column$ > ?}} Raising column = create_date and when i issue the query without any coversions, and index it on a.created directly, it gives me the same result as well. And to add upon it, i added the following in props.conf. [source::dbmon-tail://Perf-OLTP/mon_server_stats_with_epoch_conversion] TIME_FORMAT=%S MAX_DAYS_AGO = 3650 TZ = US/Pacific and in inputs.conf, i added these two columns. [dbmon-tail://Perf-OLTP/mon_server_stats_with_epoch_conversion] host = perf70 index = try_props_epoch output.format = kv output.timestamp = 1 output.timestamp.column = created_date output.timestamp.format = yyyy-MM-dd HH:mm:ss output.timestamp.parse.format = yyyy-MM-dd HH:mm:ss query = SELECT *\r\n FROM (SELECT TO_CHAR (NEW_TIME (epoch_to_date (a.created), 'GMT', 'PDT'),\r\n 'YYYY-MM-DD HH24:MI:SS'\r\n ) created_date,\r\n a.cobrand_id, a.cache_item_id, a.sum_info_id, a.server_type,\r\n a.server_stats_id\r\n FROM temp_sg_server_stats a) {{WHERE $rising_column$ > ?}} sourcetype = monitor_server_stats_epoch_conversion tail.rising.column = created_date Experts, please provide a solution for this. ... View more