I have a couple of DB Connect Inputs using DB Connect v2.0.3 with MS Integrated Authentication pulling data using tail input mode from different servers and databases and they are pulling data with Date fields which look like epoch without the period. I have a date field with 13 digits so when I convert them in a Splunk search, the date comes back as 12/31/9999 23:59:59. I have tried putting %s%3N in the "Input Timestamp Format" with no luck. This is what I am using to convert the date in the search: convert ctime(CREATED) as local_time . I was not able to get DB Connect v1 to work in our environment and v2 was a struggle to get working with Integrated Authentication, but it is now working, just having trouble with that date field. The kicker is its every Date field so at least splunk is being consistent.
Any help or thoughts would be appreciated.
... View more