This is an interesting one... Splunk DB Connect 1 connects to the Oracle 11g db and retrieves an XMLType column just fine when queried like so: SELECT FIELD1,X.XML_DOCUMENT.GETCLOBVAL() as XML_DOC,FIELD2,FIELD3,FIELD4,FIELD5 FROM Data.table X Splunk DB Connect 2 - same driver, same database, same credentials, same command, gets "## Not Supported Type ##" for the XML_DOC field, but the others come back fine. ojdbc6.jar in both cases. DBX v1 is using built-in OS Java version (1.7.0, IBM) DBX v2 is using a local Java (1.8.0_45, Oracle) What do you think? Java version problem? DBXv2 code problem? Has anyone else encountered this? Thanks for any assistance! ... View more

We were struggling with migrating loadjob-based dashboards to something that works with Search Head Clustering (loadjob isn't SHC-ready yet- it doesn't load artifacts that should be replicated; it's on the known-issues list for 6.2.0,1,2,3) I'd read all the documentation, or so I thought, but missed something in the simple xml reference that Support highlighted. The new search tag can take an attribute called 'ref'. The docs refer to this as loading a report, and this is what we can use instead of a loadjob command- but only in dashboards. Eg: 6.1: <searchString>| loadjob savedsearch="user:app:my_great_search" | stats count by host</searchString> 6.2: <search ref="my_great_search"> | stats count by host</search> We can check if it works by using the job inspector and checking the SID is named after the scheduler; if it is, it's loaded from the results of the previous run of the scheduled saved search. If not, then the search had to run again. Bonus- because it's a different attribute to the search tag, then we can still benefit from the other features of 6.2 search tags, like using the report as one of a dashboard's base searches. Hope this helps someone else avoid this issue. Thanks to Support again for pointing me in the right direction. ... View more