I actually ran into this last night and found a fix that I thought i would share. Basically the way i understand it is that the database has a DateTime field that is empty and the java driver doesn't like it. So you can add a parameter to the jdbcUrl to tell it to covert them to Nulls like so: jdbcUrlFormat = jdbc:mysql://<host>:<port>/<database>?zeroDateTimeBehavior=convertToNull This should be in your local/db_connection_types.conf file (in my case under a mysql stanza. I found this information here: https://stackoverflow.com/questions/11133759/0000-00-00-000000-can-not-be-represented-as-java-sql-timestamp-error ... View more

This explains it perfectly. I was overlooking _raw in the events tab. doing as you show here works as expected. Thanks! ... View more

Take a sample, use use the data preview to test your timestamp format extraction. see http://docs.splunk.com/Documentation/Splunk/6.0.1/Data/Configuretimestamprecognition http://docs.splunk.com/Documentation/Splunk/6.0.1/Data/ConfigurePositionalTimestampExtraction and for the timeformat, http://pubs.opengroup.org/onlinepubs/009695399/functions/strptime.html As first sight, Your timestamp TIME_FORMAT looks like "20120309203829.9230-050000" -> "%Y%m%d%H%M%S.%4N%Z" ... View more