All Apps and Add-ons

Splunk DB Connect: Why am I getting "The value is not set for the parameter number 1" when updating the SQL query in the Edit Input panel?

pkeller
Contributor

As I go through the manual process of trying to migrate queries from dbConnect v1.x to dbConnect 3.1.3, I'm having issues with the Edit Input panel.

I follow the steps.

  1. Choose a valid connection - check
  2. Browse structure and type SQL .... - check
  3. Pick a rising column and set the checkpoint value - check
  4. Update SQL to accept the checkpoint value and make sure it works.

This is where I run into a problem.The second I start typing "WHERE TIME_STAMP > ? .... The Rising Column dropdown completely empties out and the query returns:

com.microsoft.sqlserver.jdbc.SQLServerException: The value is not set for the parameter number 1. ( No results found )

This makes me unable to save the query and actually set a Rising Column and a Checkpoint Value

If I execute the same query using EVENT_TIME, things work ... but, both EVENT_TIME and TIME_STAMP are 'bigint' objects, and they both show up in the batch query results, so the question would be, why is TIME_STAMP an invalid field to use as a rising column in dbConnect 3 but works perfectly in dbConnect 1?

The target database is MS SQL Server

0 Karma

vishaltaneja070
Motivator

You can use it but it is not recommended to have date time column as rising column.

And also, one you put where TIME_STAMP > 1, then you will be able to see the rising column list again.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...