Advice on tailing database based on commit timestamp

[gwiley_splunk]

I have a database table that I want to index using dbmon-tail based on the commit time column. If I have multiple rows that have the same commit timestamp can I get into a situation where some rows won't be indexed if, for example, there is a network disconnect between Splunk and the database?

For example, there are 10 rows all with the same batch commit timestamp but Splunk only got 3 of them before a disconnect occurred. When the connection is restored would Splunk only continue from the next newer timestamp, assuming that there is no other column that could be used as a rising column?

Is there any difference in behaviour in this case between v1 and v2 of DB Connect?

Cheers

[jcoates_splunk · Accepted solution]

No, this is a standard risk of using time as the rising column. Some form of database change will be needed. Either add a unique Row ID column, or increase the resolution of the existing time column.

[gwiley_splunk]

Thanks, you've confirmed what I thought.

And there's no difference in behaviour between v1 and v2 in this regard?

[jcoates_splunk]

That's correct.