<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Are there any negative ramifications when adding a field to existing database input? in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/Are-there-any-negative-ramifications-when-adding-a-field-to/m-p/609197#M105644</link>
    <description>&lt;P&gt;I have an existing database input that is reading from an Oracle database.&amp;nbsp; Existing Dashboard A uses that database input.&amp;nbsp;&lt;/P&gt;
&lt;P&gt;I want to use the same database input on a new Dashboard B, but to do so I would need to include one additional field in the SELECT statement of the database input.&amp;nbsp; It wouldn't change how many rows are returned by the query (no select distincts), and no additional joins are needed.&amp;nbsp; Are there any negative ramifications of doing this, or am I good to go?&amp;nbsp; We only have a PROD environment, so I want to be extra cautious in making any changes.&lt;/P&gt;</description>
    <pubDate>Thu, 11 Aug 2022 17:30:40 GMT</pubDate>
    <dc:creator>dirtebird</dc:creator>
    <dc:date>2022-08-11T17:30:40Z</dc:date>
    <item>
      <title>Are there any negative ramifications when adding a field to existing database input?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Are-there-any-negative-ramifications-when-adding-a-field-to/m-p/609197#M105644</link>
      <description>&lt;P&gt;I have an existing database input that is reading from an Oracle database.&amp;nbsp; Existing Dashboard A uses that database input.&amp;nbsp;&lt;/P&gt;
&lt;P&gt;I want to use the same database input on a new Dashboard B, but to do so I would need to include one additional field in the SELECT statement of the database input.&amp;nbsp; It wouldn't change how many rows are returned by the query (no select distincts), and no additional joins are needed.&amp;nbsp; Are there any negative ramifications of doing this, or am I good to go?&amp;nbsp; We only have a PROD environment, so I want to be extra cautious in making any changes.&lt;/P&gt;</description>
      <pubDate>Thu, 11 Aug 2022 17:30:40 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Are-there-any-negative-ramifications-when-adding-a-field-to/m-p/609197#M105644</guid>
      <dc:creator>dirtebird</dc:creator>
      <dc:date>2022-08-11T17:30:40Z</dc:date>
    </item>
    <item>
      <title>Re: Are there any negative ramifications when adding a field to existing database input?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Are-there-any-negative-ramifications-when-adding-a-field-to/m-p/609199#M105645</link>
      <description>&lt;P&gt;It depends.&lt;/P&gt;&lt;P&gt;It depends on how Dashboard A uses the fields in the database input.&amp;nbsp; If there is a &lt;FONT face="courier new,courier"&gt;fields&lt;/FONT&gt; command early in each query then you're golden because the dashboard (mostly) won't even notice the new field.&amp;nbsp; I say "mostly" because there will be some (probably minor) performance impact from carrying around the new field until the first &lt;FONT face="courier new,courier"&gt;fields&lt;/FONT&gt; or other transforming command discards it.&amp;nbsp; The degree of impact will depend on the size of the new field.&lt;/P&gt;&lt;P&gt;It depends on whether the dashboard uses the &lt;FONT face="courier new,courier"&gt;foreach&lt;/FONT&gt; command without first limiting the fields in the query.&amp;nbsp; A command like &lt;FONT face="courier new,courier"&gt;| foreach * [ do stuff ]&lt;/FONT&gt; may have unexpected results when a new field is added.&lt;/P&gt;&lt;P&gt;It depends on how Dashboard A searches for data.&amp;nbsp; If a query looks for a literal string without a field name (&lt;FONT face="courier new,courier"&gt;index=foo "bar"&lt;/FONT&gt;) then it may produce unexpected results if that value exists in the new field.&lt;/P&gt;</description>
      <pubDate>Thu, 11 Aug 2022 17:35:26 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Are-there-any-negative-ramifications-when-adding-a-field-to/m-p/609199#M105645</guid>
      <dc:creator>richgalloway</dc:creator>
      <dc:date>2022-08-11T17:35:26Z</dc:date>
    </item>
  </channel>
</rss>

