Solved: Are there some good examples on the format of the ... - Splunk Community

Splunk Search

Are there some good examples on the format of the SQL for tails that are custom and have a where clause?

1 Solution

Solution

I have been able to answer my own question. Here are some key items to keep in mind:

For Oracle make sure you put the name of the rising column in caps otherwise you get oracle errors
When using date make sure you wrap the parameter in a to_date, e.g. {{AND $rising_column$ > to_date(?,'YYYY-MM-DD"T"HH:MI:SS')}}. Note the format you use should be the same as the format that you selected

View solution in original post

Solution

I have been able to answer my own question. Here are some key items to keep in mind:

For Oracle make sure you put the name of the rising column in caps otherwise you get oracle errors
When using date make sure you wrap the parameter in a to_date, e.g. {{AND $rising_column$ > to_date(?,'YYYY-MM-DD"T"HH:MI:SS')}}. Note the format you use should be the same as the format that you selected

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...