Splunk Search

Why am I getting two different date values in SQL and Splunk?

gajananh999
Contributor

Dear All,

I am connecting to the oracle database and i have multiple tables there so i wanted to merge more than two tables and get the data.
I trying to do sql inner join query but its not working for me so what i thought was get all the table data into splunk and merge it in splunk

Sql Query : sql + ROUND((MAX(PRS.END_DATE) - MIN(PRS.START_DATE)) * 3600,2) AS Run_Time_in_Sec + sql

I am getting Run_Time_in_sec as one value.

Splunk Query : search string + stats max(TOTAL) as max_total,max(END_DATE) as max_end_date,min(START_DATE) as min_start_date by ENTERPRISE_ID,RPT_QUEUE_ID | eval Run_Time_in_Sec=(max_end_date-min_start_date)*3600 | table Run_Time_in_sec

Run_Time_in_sec= some value;

Sql Query Run_Time_in_sec is different than splunk query Run_Time_in_sec

Why there is difference in final values

Can anyone tell me here where i am going wrong

0 Karma

pmdba
Builder

There does not appear to be any timestamp in your queries. Splunk isn't a relational database - it needs a timestamp in order to index data (it's all about when something happens). Besides the DBX documentation, try the Log File Analysis for Oracle 11g paper for a primer on getting data from Oracle into Splunk. Also check out this post on date formatting when indexing Oracle data into Splunk.

gajananh999
Contributor

Can anyone help me out here

0 Karma

ppablo
Retired

Hi @gajananh999

Did @pmdba's response answer your question? You upvoted it, but you didn't accept it as an answer by clicking on the "Accept" button below the content of their post. Just want to make sure because this question can be marked as solved (as well as any other of your questions with correct answers that haven't been accepted yet) so other people with the same question can find this post much easier. This will prevent people from asking the same questions over and over again. Plus, you both get karma points 🙂 thanks!

Patrick

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...