I've a DBconnect on a MSSQL
My Timestamp in the DB looks like this : 2013-04-04 15:24:36.7170000
I've defined the folowing
output.timestamp.format = "yyyy-MM-dd HH:mm:ss.SSS"
output.timestamp.parse.format = "yyyy-MM-dd HH:mm:ss.SSS"
The output from Splunk is
1970-01-01 00:59:59.999 !
I've tried to truncate the input to 2013-04-04 15:24:36.717 first, but same result
You can also do:
| convert timeformat="%Y/%m/%d" ctime(name of your date column) as NEWDATE
substitute the %Y/%m/%d for whatever time periods you want to show up.
The alternative is to define a search macro for it instead.
I've found that there is no global way for Splunk to parse MySQL or MSSQL timestamps
ok that will always work, the same for a to_char in sql... but I doesn't want to make that for each date field and for each query...
I've found some possibility in oracle : alter session set NLS_DATE_FORMAT='DD-MON-YY'
But I'm not able to use that command in DBquery
I've found some possibility in oracle :
alter session set NLS_DATE_FORMAT='DD-MON-YY'
But I'm not able to use that command in DBquery