topic Re: Splunk DB Connect: Is it possible to clear all rows in database and add all results (old and new) for every execution? in All Apps and Add-ons

Splunk DB Connect: Is it possible to clear all rows in database and add all results (old and new) for every execution?

ankithreddy777 — Mon, 30 Jan 2017 19:21:05 GMT

Hi,
I have to send results to the database from Splunk using Splunk DB Connect. But in documentation it is given that for every execution only the updated results will added to database table.
Is it possible to clear all rows in database and add all results (old and new) for every execution?

Re: Splunk DB Connect: Is it possible to clear all rows in database and add all results (old and new) for every execution?

gcusello — Tue, 31 Jan 2017 08:06:51 GMT

Hi ankithreddy777,
using DB Connect you can acquire records in two ways:

all query results;
only newest records. you can choose the preferred Input Type in the creation of database input (see http://docs.splunk.com/Documentation/DBX/2.4.0/DeployDBX/Createandmanagedatabaseinputs#Choose_and_preview_table) If you choose "batch input" you take all the times all the query's results, if you choose "Rising column" you have to choose a field, always growing, to use to record the check point (Splunk records in a configuration file the last value of the rising column from the executed query and uses it as starting point for the next one). There is also a third choose ("Advanced") similar to "Rising column". Bye. Giuseppe

Re: Splunk DB Connect: Is it possible to clear all rows in database and add all results (old and new) for every execution?

ankithreddy777 — Tue, 31 Jan 2017 12:39:05 GMT

Hi Cusello,
How to send all results to the database for every execution. Instead of only new results using database. Can we delete results in database?

Re: Splunk DB Connect: Is it possible to clear all rows in database and add all results (old and new) for every execution?

gcusello — Tue, 31 Jan 2017 12:49:13 GMT

No the "Batch input" option permits to download all the results of a query, but it doesn't delete records from DB, it's possible but you have to grant deletion privileges to the user that you use to connect to your DB (it isn't a usual procedure!) and create another DB script to delete the downloaded records.

Why you don't want to use the "Rising column" method? it's really more efficient!
If the problem is that you have rotation of your DB (in this way your rising column will be reset at every file rotation), you can manage this situation in an easy way:

add to your query an additional field resulting by timestamp + growing code
use this new field as rising column. In this way your rising column will be always growing.

Bye.

Giuseppe

Re: Splunk DB Connect: Is it possible to clear all rows in database and add all results (old and new) for every execution?

woodcock — Sat, 04 Mar 2017 06:55:20 GMT

You are probably aware that you have posted this question twice, right?

https://answers.splunk.com/answers/494339/delete-database-results-and-update-with-new-result.html#answer-507489