topic Re: When using Splunk to retrieve data from an Oracle database, how do I reduce the returned results to only the last 30 days? in Getting Data In

When using Splunk to retrieve data from an Oracle database, how do I reduce the returned results to only the last 30 days?

karthi2809 — Mon, 08 Oct 2018 06:33:44 GMT

Splunk database input query from oracle database ?

I am using Oracle database to retrieve data to Splunk and the database is getting slow because of searching from given data. So i need to reduce only last 30 days data.

Query :

SELECT test.request_ts FROM test WHERE  test.Request_Ts > '2018-10-05 00:00:00.000'
{{AND test.$rising_column$ > ? }}

Thanks in advance

Re: When using Splunk to retrieve data from an Oracle database, how do I reduce the returned results to only the last 30 days?

iamarkaprabha — Mon, 08 Oct 2018 15:34:37 GMT

Hi karthi2809,

You can use DB Connect app and index the whole db data into splunk.
After you index the data, it will resolve the performance issue

Re: When using Splunk to retrieve data from an Oracle database, how do I reduce the returned results to only the last 30 days?

karthi2809 — Tue, 09 Oct 2018 05:22:17 GMT

I am using db connect app only.but database getting slow

Re: When using Splunk to retrieve data from an Oracle database, how do I reduce the returned results to only the last 30 days?

iamarkaprabha — Tue, 09 Oct 2018 05:35:31 GMT

Did you index the data ?
or are you using just dbx query

Re: When using Splunk to retrieve data from an Oracle database, how do I reduce the returned results to only the last 30 days?

karthi2809 — Tue, 09 Oct 2018 06:15:13 GMT

indexed the data.

Re: When using Splunk to retrieve data from an Oracle database, how do I reduce the returned results to only the last 30 days?

karthi2809 — Tue, 09 Oct 2018 06:17:21 GMT

I need to fetch last 30 days data to splunk.

Re: When using Splunk to retrieve data from an Oracle database, how do I reduce the returned results to only the last 30 days?

iamarkaprabha — Tue, 09 Oct 2018 06:29:36 GMT

Hi ,

You can do one thing. Put the timestamp of the particular column in your DB table into Splunk. Any try that one out. It will index the data using the same timestamp of your DB.

Have you tried this method ??