Hi ir-respective of what timestamp is present in timestamp column of my Oracle DB, the timestamp in the event is replaced to "1970-01-01 00:59:59".
In oracle DB the timestamp column contains data like 2013-09-19T14:31:12
and the configuration in my inputs.conf is
[dbmon-tail://SAMPLE/SPLUNK_USER.SAMPLEINPUT]
host = testhost
interval = * * * * *
output.format = kv
output.timestamp = 1
output.timestamp.column = PAYLOADDATE
output.timestamp.parse.format = yyyy-MM-dd HH:mm:ss
sourcetype = test_st
table = SPLUNK_USER.SAMPLEINPUT
tail.rising.column = PAYLOADDATE
index = default
query = SELECT * FROM SAMPLEINPUT {{WHERE $rising_column$ > ?}}
output.timestamp.format = yyyy-MM-dd HH:mm:ss
Note: PAYLOADDATE column is a varchar2 type
Can you please highlight what i am doing wrong?
For your output and output parse formats, have you tried:
yyyy-MM-dd'T'HH:mm:ss
what is the column type in your database? have you tried adding a SQL cast or convert to your SQL statement?
For your output and output parse formats, have you tried:
yyyy-MM-dd'T'HH:mm:ss
You're welcome.
??? When you save the input configuration it should reset the connection and create log entries. If there are no errors, then you should see something like:
INFO:TailDatabaseMonitor - Database monitor - your input - finshed with status=true resultCount=xxx in duration=xxxxms
and
Scheduler - Execution of input= your db input finished in duration=xxx with resultCount=xxx success=true continuemonitoring=true.
But that means it is working.
My mistake i used only T changed it to 'T' its working now thnx
there are no errors in dbx logs
What is the error in the dbx log?
then nothing gets indexed