We could not obtain the data because the database connection or warehouse table is changed. Encountered error: IVEProcessHeadInfo failed. Error type: Data Import Error. Error occurs when processing the head info...”
CAUSE:The issue is related to the underscore character in the column name. By default, Splunk adds this underscore before its time search index, but the Strategy engine cannot handle the underscore character in some scenarios. This is limited to the “Pick Tables” and "Build a Query" Data Import options which use the underscore in the column alias.
WORKAROUNDS:
1. Use "Type a Query" in the select import option instead. By using "type a query", the generated SQL in the above data import cube is:
select b,
h,
host,
idx,
pool,
s,
st,
_time
from [DMC License Usage Data Cube];
Note: No column aliases are used. This will get all columns including "_time".
2. Use "Build a Query" in the select import option and manually alter the column alias.
By using "Build a query", the generated SQL is:
select DMC_License_Usage_Data_Cube.b b,
DMC_License_Usage_Data_Cube.h h,
DMC_License_Usage_Data_Cube.host host,
DMC_License_Usage_Data_Cube.idx idx,
DMC_License_Usage_Data_Cube.pool pool,
DMC_License_Usage_Data_Cube.s s,
DMC_License_Usage_Data_Cube.st st,
DMC_License_Usage_Data_Cube.[_time] [_time]
from [DMC License Usage Data Cube] DMC_License_Usage_Data_Cube;
Alter this statement to:
select DMC_License_Usage_Data_Cube.b b,
DMC_License_Usage_Data_Cube.h h,
DMC_License_Usage_Data_Cube.host host,
DMC_License_Usage_Data_Cube.idx idx,
DMC_License_Usage_Data_Cube.pool pool,
DMC_License_Usage_Data_Cube.s s,
DMC_License_Usage_Data_Cube.st st,
DMC_License_Usage_Data_Cube.[_time] timefrom [DMC License Usage Data Cube] DMC_License_Usage_Data_Cube;
Renaming the "_time" alias as "time" will resolve the issue.
3. Use Connect Live
