Splunk Search

DB Connect - Oracle - Single quote in query

johnoxley_liqui
Engager

I am have the following stanza in my inputs.conf.

[dbmon-tail://DB/TABLE]
interval = 1m
query = SELECT SL_UID,SL_TIMESTAMP,from_tz(SL_TIMESTAMP, 'Europe/London') AT TIME ZONE 'UTC' AS SL_TIMESTAMP_UTC FROM schema.TABLE {{WHERE $rising_column$ > ?}}
tail.rising.column = SL_UID
output.format = kv
output.timestamp.column = SL_TIMESTAMP
sourcetype = mydata
disabled = 0
index=test

When I run the query from Oracle's SQL Developer, I get the expected one hour difference between SL_TIMESTAMP and SL_TIMESTAMP_UTC.

The output from Splunk DBX is

2014-04-08T15:00:45.000 SL_UID=21342912 SL_TIMESTAMP_UTC=

Having decompiled dbx.jar, I think the problem is in com.splunk.util.Utils.unescapeString() not unescaping the single quote ' correctly.

Is this a bug or have I configured something incorrectly?

pmdba
Builder

Single quotes can be escaped with a back slash: \'

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...