topic Splunk DB Connect: How to ingest only recent Oracle DB logs? in All Apps and Add-ons

Splunk DB Connect: How to ingest only recent Oracle DB logs?

sshres5 — Thu, 05 Jan 2017 21:43:19 GMT

I am trying to ingest logs residing in Oracle DB through Splunk DB Connect (DB2), it dates back to couple of years. Currently it is only ingesting old logs, even though I have used a checkpoint value it doesn't seem to work.

I just want to ingest logs starting like a week ago.

Re: Splunk DB Connect: How to ingest only recent Oracle DB logs?

jplumsdaine22 — Tue, 29 Sep 2020 12:18:39 GMT

What does your inputs.conf (in $SPLUNK_HOME$/etc/apps/splunk_app_db_connect/local/inputs.conf) look like?

Re: Splunk DB Connect: How to ingest only recent Oracle DB logs?

sjohnson_splunk — Fri, 06 Jan 2017 15:45:40 GMT

Add a where clause to your select statement that specifies a timestamp field > a week ago. Presumable you could use some sql date function to make the calculation on the fly vs. having to hard code an actual date/time value.

Re: Splunk DB Connect: How to ingest only recent Oracle DB logs?

sshres5 — Fri, 06 Jan 2017 17:26:30 GMT

So I tried using the where clause, getting error. Probably I am not using the function properly
where TIMESTAMP >= '2017-01-01 00:00:00'

"None", caused by: Exception(' java.sql.SQLDataException: ORA-01843: not a valid month\n.',). "

Re: Splunk DB Connect: How to ingest only recent Oracle DB logs?

sshres5 — Tue, 29 Sep 2020 12:18:48 GMT

tail_rising_column_checkpoint_value = 1340340698871

Re: Splunk DB Connect: How to ingest only recent Oracle DB logs?

sshres5 — Mon, 09 Jan 2017 20:29:48 GMT

I was able to get the query right, however 0 rows returned.

where TIMESTAMP >= timestamp'2017-01-01 00:00:00'

Re: Splunk DB Connect: How to ingest only recent Oracle DB logs?

sshres5 — Sun, 22 Jan 2017 16:58:28 GMT

So I got this working by manually appending the inputs.conf file's tail rising value and then using 'where' clause in the Rising column's SQL query.