All Apps and Add-ons

Splunk DBConnect Issue Unrecognized option: Date, case when

reverse
Contributor
Unrecognized option: Date, case when trunc(sysdate-aafa.app_recvd_dt) <=4 then 4 days or less when trunc(sysdate-aafa.app_recvd_dt) between 5 and 7 then '5 to 7 days' when trunc(sysdate-aafa.app_recvd_dt) between 8 and 15 then '8 to 15 days' when trunc(sysdate-aafa.app_recvd_dt) between 16 and 21 then '16 to 21 days' when trunc(sysdate-aafa.app_recvd_dt) between 22 and 30 then '22 to 30 days' when trunc(sysdate-aafa.app_recvd_dt) between 31 and 45 then '31 to 45 days' when trunc(sysdate-aafa.app_recvd_dt)>45 then 'More than 45 days' end as span, rtapp.description AS Application

The query is running fine in SQL explorer but not in splunk.

Query...

...
...
...
...
..
...
case when trunc(sysdate-aafa.app_recvd_dt) <=4 then '4 days or less'
when trunc(sysdate-aafa.app_recvd_dt) between 5 and 7 then '5 to 7 days'
when trunc(sysdate-aafa.app_recvd_dt) between 8 and 15 then '8 to 15 days'
when trunc(sysdate-aafa.app_recvd_dt) between 16 and 21 then '16 to 21 days'
when trunc(sysdate-aafa.app_recvd_dt) between 22 and 30 then '22 to 30 days'
when trunc(sysdate-aafa.app_recvd_dt) between 31 and 45 then '31 to 45 days'
when trunc(sysdate-aafa.app_recvd_dt)>45 then 'More than 45 days' end as span,
...
...
..
..
.
.
.
.
.
.
.
Tags (2)
0 Karma
1 Solution

reverse
Contributor

The issue was spaces in aliases. Not at all related to error thrown

View solution in original post

0 Karma

reverse
Contributor

The issue was spaces in aliases. Not at all related to error thrown

0 Karma

maciep
Champion

if you get rid of the case statements, does it run? if not, there's probably something wrong elsewhere causing the issue to show up there? If it does, then maybe try one condition in the case, then the next and so on to see where it's getting upset exactly.

0 Karma

p_gurav
Champion

try using else in case command before end.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...