topic Re: Splunk DB Connect: Why did my dbmon-tail input to fetch data from a SQL query stop tailing data after 1 day? in Deployment Architecture

Splunk DB Connect: Why did my dbmon-tail input to fetch data from a SQL query stop tailing data after 1 day?

xbbj3nj — Fri, 20 Mar 2015 07:08:56 GMT

Hi,

I have setup a dbmon-tail to fetch data from a SQL query every 15 minutes. It works as expected for a day until night, and suddenly the next day it stops tailing data.

Select * from ArcUnion {{WHERE $rising_column$ > ?}}

In the interval I have set as 15m.

Can you please tell me what's the issue here?

Re: Splunk DB Connect: Why did my dbmon-tail input to fetch data from a SQL query stop tailing data after 1 day?

PPape — Fri, 20 Mar 2015 08:31:57 GMT

Could you please paste your inputs.conf and did you check your splunkd.log for errors?

Re: Splunk DB Connect: Why did my dbmon-tail input to fetch data from a SQL query stop tailing data after 1 day?

xbbj3nj — Mon, 28 Sep 2020 19:11:53 GMT

Hi ,

Below is my inputs.conf...

[dbmon-tail://Essmon_wnpcpdbeso01/ESO_DB_wnpcpdbeso01]
host = wnpcpdbeso01
index = eso
interval = 15m
output.format = mkv
output.timestamp = 1
output.timestamp.column = Timegenerated
query = Select * from ArcUnion {{WHERE $rising_column$ > ?}}
table = ESO_DB_wtpcpdbeso04
tail.rising.column = Timegenerated
disabled = 0

Re: Splunk DB Connect: Why did my dbmon-tail input to fetch data from a SQL query stop tailing data after 1 day?

mzorzi — Fri, 20 Mar 2015 11:52:46 GMT

try to use the full jdk installation from Oracle.

Re: Splunk DB Connect: Why did my dbmon-tail input to fetch data from a SQL query stop tailing data after 1 day?

xbbj3nj — Fri, 20 Mar 2015 11:53:10 GMT

what do you meany by that ? you want me upgrade the DBX app ?

Re: Splunk DB Connect: Why did my dbmon-tail input to fetch data from a SQL query stop tailing data after 1 day?

rickalmva — Mon, 23 Mar 2015 18:41:57 GMT

the "Rising Column" Timegenerated, is it like (or is) Unix Epoch, ever increasing or it is time of day, resetting to a lower value nightly ? Remember the query is looking for records where the value of Timegenerated is > (greater than) any value seen before.

Just checking the simple things

Re: Splunk DB Connect: Why did my dbmon-tail input to fetch data from a SQL query stop tailing data after 1 day?

xbbj3nj — Tue, 24 Mar 2015 07:27:52 GMT

Rickamva,
Thanks for the response.
Timegenerated coloumn is ever increasing value, its a unix timestamp field which keeps on changing at any point of time.

Re: Splunk DB Connect: Why did my dbmon-tail input to fetch data from a SQL query stop tailing data after 1 day?

vincenteous — Fri, 27 Mar 2015 05:12:01 GMT

Does your dbx.log report anything related to an error? You may want to check that log instead of splunkd.log to start the troubleshoot process.

Re: Splunk DB Connect: Why did my dbmon-tail input to fetch data from a SQL query stop tailing data after 1 day?

karabsze — Fri, 27 Mar 2015 05:58:27 GMT

Have you also tried to change the interval to cron expression ?