Deployment Architecture

Field names from same DB Inputs on different indexers have different cases...

dlovett
Path Finder

I have two indexers: one legacy where DB Connect 1.0.x was installed and updated as releases come out and another that is brand new with DB Connect 1.1.1 as the initial instal. The field names on the legacy indexer are all caps where the field names on new indexer are all lowercase.

Both use DB Inputs with same settings and SQL except for the name of the index;

There are no props or transforms used;

I couldn't find any difference in configurations on both indexers that are obvious; ie they're pretty simple setups;

Anybody else experiencing something like this with DB Connect DB inputs?

0 Karma

mchang_splunk
Splunk Employee
Splunk Employee

This issue has been resolved in 1.1.2:
Table column names were unexpectedly converted to lower case. (DBX-347)
Please refer to this link:
http://docs.splunk.com/Documentation/DBX/1.1.2/DeployDBX/Releasenotes#Fixed_problems

0 Karma

jbrodsky_splunk
Splunk Employee
Splunk Employee

There is an internal case on this, and it is a known issue. If you are a splunk customer under support, please open a case and reference JIRA DBX-340 so that we may track the fix and let you know when we have resolved it.

aelliott
Motivator

Yeah and it's new to DB Connect 1.1.1 I would think they would want to fix this sometime soon or update their documentation.

0 Karma

dlovett
Path Finder

I always assumed the field names matched the column names in the DB. ie All of the column names in our Oracle tables are uppercase and the field names on the legacy indexer all show the field names in uppercase.

This is quite the scenario :^)

0 Karma

aelliott
Motivator

Yep http://answers.splunk.com/answers/109879/case-sensitive-columns-from-sql

One workaround would be to change all your fields to lower case, but I'm not sure these should be case sensitive to begin with (or should at least match the case of the fields returned)

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...