I have added a couple of queries to extract information from Oracle databases.
The DB Info shows that I have a field that is a DATE object. In oracle thevalue is actually , which is actually a timestamp yet in Splunk we only get the date value from timestamp and not the full timestamp.
So when using the DATE field for timestamping all events are indexed as occuring ad midnight and not the actual time.
This also means we are unable to use a DATE field as the rising column.