Getting Data In

Splunk DB Connect 1: How to parse a dbquery search string to convert Unix timestamps to a readable format and create a timechart?

jtracy
Engager

I have a string like this;

| dbquery MYDATABASE "Select trunc(ph.x_rqst_date) bp_date,count(ph.objid) bpcount,ph.x_ics_rcode _code,
 X_AUTH_RESPONSE paymen_code,ph.x_payment_type type
 from x_program_purch_hdr ph    
 where x_rqst_type='CREDITCARD_PURCH'
 AND ph.x_payment_type IN ('ENROLLMENT','RECURRING')
 and ph.x_rqst_date >= Trunc(sysdate)-1
 and ph.x_rqst_date < Trunc(sysdate)
 GROUP BY trunc(ph.x_rqst_date),ph.x_ics_rcode,X_AUTH_RESPONSE,ph.x_payment_type"

But I cannot parse this query with things like |timechart count by code limit=25. Am I missing something? I want to convert all the unreadable unix timestamps to readable, and make a timechart.

0 Karma
1 Solution

justinatpnnl
Communicator

Timechart relies on having a _time field for your data. If your date field is already in epoch format, just rename the column with the date to _time:

| rename bp_date as _time

Then try adding your timechart after that. The alternative would be to name the column within your query:

Select trunc(ph.x_rqst_date) _time

View solution in original post

justinatpnnl
Communicator

Timechart relies on having a _time field for your data. If your date field is already in epoch format, just rename the column with the date to _time:

| rename bp_date as _time

Then try adding your timechart after that. The alternative would be to name the column within your query:

Select trunc(ph.x_rqst_date) _time

jtracy
Engager

This was it! Thank you kind sir.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...