Thank you very much for the solution regards Altin ps. upvote is "accept as solution"? ... View more

Thank you for your answer too   regards Altin ... View more

I am not getting: Why makeresults should be there I have an existing field "statement" from which I need to get the IP, instead of a _raw one Do not understand part "rename comment .." - I have no field named "comment" referring to part  eval raw="[CLIENT: 192.20.21.22]" part 192.20.21.22 is NOT fixed,  it is just from the example above, it is variable - what I want to get as field IP2 regards Altin ... View more

Thank You for this but it would not be acceptable to have this thing applied to all Inputs. best regards Altin ... View more

Hi @nyc_jason  I can change the UTC timestamp in local timezone in my SQL query. But this Question was asked on how do I do this on Splunk or DB Connect - and not outside. Is this possible inside Splunk 8.2 and/or DB Connect 3.6.0 ? best regards Altin ... View more

Thank you for the reply @nyc_jason . But the two parameters: timezone and  localTimezoneConversionEnabled, in the documentation for db_connections.conf.spec, do appear first on version 3.7.0. Our DB Connect is on version 3.6.0 - and the parameters above do NOT appear there: db_connections.conf.spec - 3.6.0 How do we do this on DB Connect 3.6.0 ? best regards Altin ... View more

also the below   ... View more

HI @nyc_jason  and thank you for the reply. There is no props.conf under /<home>/splunk_app_db_connect/local Since my DB Input is saved under an App called "Ub Security Hub" - and not under DB Connect, I did check also under /<home>/ub_security_hub/local. No no props.conf found there too. Should I create one? If yes, under /splunk_app_db_connect/local or /ub_security_hub/local ? And what should I write inside props.conf? Will the below ------- props.conf --------- [<sourcetype_name>] TZ=UTC ------- props.conf --------- ... be enough ? please advise best regards Altin ... View more

Thank you @richgalloway for the answer. May be I am not getting something right, but I am not looking to display the incoming field into a UNIX timestamp. I am looking to tell Splunk that this field is in UTC timezone and not local, so that the _time field is handled correctly. I could do this in the SQL pull query, but I am looking for a way Splunk ingests an UTC timestamp via DB Connent best regards Altin ... View more

In Oracle you have the unified audit trail, and there are some pre-deployed policies which you can activate and start immediately. https://docs.oracle.com/en/database/oracle/oracle-database/19/sqlrf/CREATE-AUDIT-POLICY-Unified-Auditing.html  to retrieve and visualize the trail, you can use the following Oracle Unified Audit App for Splunk https://splunkbase.splunk.com/app/6172/  best regards Altin ... View more

For Oracle Unified Audit (starting with Oracle 12c R1), you can use the following Oracle Unified Audit App for Splunk https://splunkbase.splunk.com/app/6172/  best regards Altin ... View more

If you are using Oracle Unified Audit (starting with Oracle 12c R1), you can use the following Oracle Unified Audit App for Splunk https://splunkbase.splunk.com/app/6172/  best regards Altin ... View more

If you are using Oracle Unified Audit (starting with Oracle 12c R1), you can use the following Oracle Unified Audit App for Splunk:  https://splunkbase.splunk.com/app/6172/  best regards Altin ... View more

If you are using Oracle Unified Audit, please check this: Oracle Unified Audit App for Splunk  best regards Altin ... View more

For the Oracle Unified * Audit Trail you can use the following: Oracle Unified Audit App for Splunk  * the unified audit starts in Oracle 12c R1 ... View more

I do not think that Splunk will update the LAST_ARCHIVE_TIMESTAMP - not by itself. However, in the doc Splunk says that it does support calling a procedure of an Oracle Database https://docs.splunk.com/Documentation/DBX/3.7.0/DeployDBX/Commands But I do not know if its only the case of procedures returning events as cursor to be pulled by DB Connect, or even the (your) case of a procedure just doing some actions and returning no rows. If the second is true, I guess that calling DBMS_AUDIT_MGMT.SET_LAST_ARCHIVE_TIMESTAMP( audit_trail_type IN PLS_INTEGER, last_archive_time IN TIMESTAMP, rac_instance_number IN PLS_INTEGER DEFAULT NULL, container IN PLS_INTEGER DEFAULT CONTAINER_CURRENT, database_id IN NUMBER DEFAULT NULL, container_guid IN VARCHAR2 DEFAULT NULL); https://docs.oracle.com/en/database/oracle/oracle-database/19/arpls/DBMS_AUDIT_MGMT.html#GUID-75EE6B31-98A1-4353-9000-A293E4752380 ... will set the right timestamp ... View more

Thank You very much for the help (and the solution) @sloshburch  best regards Altin ... View more