db connect trailing input

aaronkorn — Wed, 24 Jul 2013 15:21:05 GMT

Hello,

We have a database that we would like to do a trailing input on based on the incrementing ID. Once it is indexed into Splunk via the query, if that record on the database is updated will Splunk pickup that change and update the indexed record? If not should we use the dump option? My only concern with the dump option is duplicate records and how to overcome that.

Re: db connect trailing input

lukejadamec — Fri, 26 Jul 2013 13:13:44 GMT

No, it will not pick up the change because the Trailing Input functions by monitoring the RisingColumn.

You are right about the Dump option - it will create duplicate records.

The easiest way to protect from duplicate data is isolate the database data in its own index:

1) Create an index dedicated to that database data.

2) When new data is entered into the database, clean the index with $SPLUNK_HOME/bin/splunk clean eventdata -index

Note: You must stop splunkd first, and be careful with this command because you can accidentally delete all indexes.

3) Re-ingest the entire database.

Your best option would be to create a (or use) the column that timestamps any changes to a record (a true RisingColumn)

topic Re: db connect trailing input in Getting Data In

db connect trailing input

Re: db connect trailing input