In my case, there is no separate column with this data. No ID or date/time column in the table (great...) . I have to extract that data from a column and create a new value in the SQL statement, but then I can't seem to use that new field as the column for the DB connect rising column. Is this a limitation of DB Connect's rising column feature?
Example:
select column1, column2, column3, SUBSTRING(right(column3,17)) as "DateTime"
from blahblah
where DateTime > ?
order by DateTime asc
Splunk Enterprise 7.2, DB Connect 3.13
Error:
java.sql.SQLException: Parameter #1 has not been set.
You should run your SQL without rising parameter, this will allow you to select new field as rising column. After that you should add rising column filter and run query again to go next page.
First;
select column1, column2, column3, SUBSTRING(right(column3,17)) as "DateTime"
from blahblah
Second;
select column1, column2, column3, SUBSTRING(right(column3,17)) as "DateTime"
from blahblah
where DateTime > ?
order by DateTime asc
If this reply helps you an upvote is appreciated.
I was having a similar issue, query runs fine but for whatever reason Splunk wasn't liking the rising column I was picking and wouldn't let me move to the next screen. I went in and just created the input in db_inputs.conf and restarted Splunk and it started working. I'm guessing there is some logic checking that is busted in the UI for the app.