All Apps and Add-ons

DB connect 313 NULL-fields returned for varchar type

antoniofaraone
New Member

Hi all,
I installed and configured db connect 313 but all queries return blank for the varchar2 fields.
Instead, the Number and Date fields are extracted correctly

DB version is oracle 9.

alt text

Thanks a lot

0 Karma

jcoates
Communicator

@vishaltaneja07011993 is correct. If you can’t go that far, you can modify your SQL query to CAST or CONVERT the column to a type that Splunk can handle.

0 Karma

vishaltaneja070
Motivator

Hello @antoniofaraone

You need to create template which will get the data in a different format. You can place the field which is the very big in the middle of the template to avoid them breaking. Ofcourse, if your event has more than 10k characters, you might want to increase the TRUNCATE value.

This answer can help you out i guess:

https://answers.splunk.com/answers/172153/why-splunk-db-connect-is-not-properly-importing-da.html
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...