topic How do I set up Splunk DB Connect so I only get new log information every time I do a query instead of pulling the whole in Getting Data In

How do I set up Splunk DB Connect so I only get new log information every time I do a query instead of pulling the whole

dennislevine — Fri, 15 Nov 2024 16:18:38 GMT

How do I set up Splunk DB Connect so I only get new log information every time I do a query instead of pulling the whole database each time?

I've got the connection working and I'm getting data in, but every time the input runs it pulls the entire database again instead of just pulling in the newest data. How do I limit what it pulls?

Re: How do I set up Splunk DB Connect so I only get new log information every time I do a query instead of pulling the w

richgalloway — Fri, 15 Nov 2024 17:30:01 GMT

Use a Rising input. This is where DBX keeps track of the last value seen for a specific field so subsequent queries can fetch newer values.

See https://docs.splunk.com/Documentation/DBX/3.18.1/DeployDBX/Createandmanagedatabaseinputs#Choose_input_type for details.