Cribl DB Collector State Tracking Fails with Oracle Due to Column Name Case Mismatch

Symptom

The Cribl Stream DB Collector does not track state correctly when collecting from an Oracle database. The collector re-reads data it has already collected, or state tracking does not advance, even though the SQL query executes successfully. You may see the error message Tracking column <name> contained non-number/non-string value if the tracking column returns an unsupported data type such as a native date/time value.

Environment

• Cribl Stream
• DB Collector source
• Oracle database

Resolution

1. Ensure the state tracking column is not a native date/time data type. If your query uses a date/time column for state tracking, modify the SQL query to convert it to a numeric epoch value or a consistently formatted string.

   1. For string conversion, use Oracle's TO_CHAR function on the date column in the SELECT statement. Use a lexicographically sortable format such as TO_CHAR(your_date_col, 'YYYY-MM-DD HH24:MI:SS') so that string comparison preserves chronological order.

   2. For epoch milliseconds (the safer approach per Cribl documentation), convert the date column to a numeric value representing milliseconds since epoch.

2. Define the State Tracking Column field in the DB Collector configuration to exactly match the column name or alias returned by your query, including case. Oracle returns unquoted identifiers and aliases in UPPERCASE by default, so if your query uses an unquoted alias (e.g., SELECT TO_CHAR(event_ts, 'YYYY-MM-DD HH24:MI:SS') AS EVENT_TS_STR), the configuration must use EVENT_TS_STR in uppercase. If you use a quoted alias (e.g., AS "event_ts_str"), the configuration must match that exact case instead.

3. Ensure your query includes an ORDER BY clause on the tracking column so that values increase monotonically. State tracking requires rows to be returned in ascending order of the tracking value.

4. Save and commit the updated configuration.

5. Verify that the collector now advances state correctly on subsequent collections.

Cause

This can be caused by:

• Oracle returning unquoted column names and aliases in ALL UPPERCASE by default, while the DB Collector State Tracking Column field is configured with different case. The Cribl DB Collector performs a case-sensitive match between the configured tracking column name and the column name returned by the query. A case mismatch prevents Cribl from identifying the correct column to track state.
• Using a native date/time data type column for state tracking. The Cribl DB Collector requires the tracking column value to be a standardized numeric or string format (such as a Unix epoch timestamp or a simple integer). Native date/time values produce the error Tracking column <name> contained non-number/non-string value.