https://community.splunk.com/t5/All-Apps-and-Add-ons/splunk-Dbconnect-index-issue/m-p/461089#M56741 <P>For updated rows to be processed by DBX you need a rising column value which changes whenever the row is updated.</P> <P>Commonly, databases may have an "updated" column in which the timestamp or an incremental unique ID is modified whenever any other column in that record is amended.<BR /> If you have such a field in your database, you should use this value as the rising column, and sort the table results by "updated".</P> <P>If your database does not have such a column, your choices are:<BR /> Have it introduced by the developers/dba<BR /> Use a batch process to import rows on a schedule - in many cases this will likely lead to some data duplication, so you will need to deduplicate, or otherwise handle this in Splunk</P> <P><A href="https://docs.splunk.com/Documentation/DBX/3.2.0/DeployDBX/Createandmanagedatabaseinputs">https://docs.splunk.com/Documentation/DBX/3.2.0/DeployDBX/Createandmanagedatabaseinputs</A></P> Tue, 04 Feb 2020 07:58:59 GMT nickhills 2020-02-04T07:58:59Z https://community.splunk.com/t5/All-Apps-and-Add-ons/splunk-Dbconnect-index-issue/m-p/461088#M56740 <P>i have 2 fields with open _issue_timestamp and closed_issue_issue.<BR /> when the ticket is opened the time will be updated in opened_issue and once action is taken the timestamp will be updated in closed_issue column later point of time.<BR /> so if we configure DB_input using ID it will not capture the closed_issue column when a new Ticket is opened ?<BR /> how to over come this issue?</P> Wed, 30 Sep 2020 04:01:42 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/splunk-Dbconnect-index-issue/m-p/461088#M56740 DataOrg 2020-09-30T04:01:42Z https://community.splunk.com/t5/All-Apps-and-Add-ons/splunk-Dbconnect-index-issue/m-p/461089#M56741 <P>For updated rows to be processed by DBX you need a rising column value which changes whenever the row is updated.</P> <P>Commonly, databases may have an "updated" column in which the timestamp or an incremental unique ID is modified whenever any other column in that record is amended.<BR /> If you have such a field in your database, you should use this value as the rising column, and sort the table results by "updated".</P> <P>If your database does not have such a column, your choices are:<BR /> Have it introduced by the developers/dba<BR /> Use a batch process to import rows on a schedule - in many cases this will likely lead to some data duplication, so you will need to deduplicate, or otherwise handle this in Splunk</P> <P><A href="https://docs.splunk.com/Documentation/DBX/3.2.0/DeployDBX/Createandmanagedatabaseinputs">https://docs.splunk.com/Documentation/DBX/3.2.0/DeployDBX/Createandmanagedatabaseinputs</A></P> Tue, 04 Feb 2020 07:58:59 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/splunk-Dbconnect-index-issue/m-p/461089#M56741 nickhills 2020-02-04T07:58:59Z