topic DBconnect update data error in Getting Data In

DBconnect update data error

laiyongmao — Fri, 06 Dec 2013 02:18:19 GMT

I use DBconnect, when I update the data in the database, a fault occurs, the inside of the Splunk display information and database display different.i think it is a bug..

In the database.

mysql> update updatetest set ID=ID+1;

mysql> select * from updatetest;
+------+------+
| ID | name |
+------+------+
| 2 | jim |
| 3 | anny |
+------+------+
2 rows in set (0.00 sec)

on my splunk

search index=updatetest
13-12-5 下午07时12分19.000秒 id=3 name=anny
host = localhost source = dbmon-tail://updatetest/updatetest sourcetype = updatetest

13-12-5 下午07时07分05.000秒 id=2 name=anny
host = localhost source = dbmon-tail://updatetest/updatetest sourcetype = updatetest

13-12-5 下午07时07分05.000秒 id=1 name=jim
host = localhost source = dbmon-tail://updatetest/updatetest sourcetype = updatetes

I don't know why, I hope someone can help me

Re: DBconnect update data error

laiyongmao — Mon, 09 Dec 2013 07:05:57 GMT

After creating an entry via either dbmon-dump or dbmon-tail inputs,
deleting the entry or creating a new entry does not remove the data from
the internal_index. This is due to a state caching issue. Workaround:
Clone the database input, then disable (or delete) the old input. (DBX-281)

Re: DBconnect update data error

laiyongmao — Mon, 09 Dec 2013 07:07:00 GMT

Have to find a solution.