I am aware this feature is not officially supported but thought I would post this question here.
We have a MSSQL table with the following format datetime time string identifier numeric thisDecimalValue (with 4 decimal places)
This screenshot shows how Splunk DB Connect sees the table http://imgur.com/tcG3kQe
Now this search/insert
sourcetype="this" earliest=-1m | eval time = _time | eval thisDecimalValue = round(thisDecimalValue,2) | fields time, identifier, thisDecimalValue | dboutput type=insert database="MSSQL Instance" table="Splunk.outputTable" time, identifier, thisDecimalValue
Ends up with the error
command="dboutput", Unexpected error while performing dboutput: java.sql.SQLException: Cannot convert value "0.00" to required datatype LONG
We have tried with MSQQL numeric and decimal for the field typebut still no joy. Getting the admins to change the field type to float but they have not done this yet.
A colleague suggested using the dboutput.conf to create a custom SQL statement. http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/dboutputspec
Can someone please shed more light on how you formulate the sql.insert string to use the results from the Splunk search?
How is it triggered as well once you have created these stanzas?
Thanks