All Apps and Add-ons

Advice on tailing database based on commit timestamp

gwiley_splunk
Splunk Employee
Splunk Employee

I have a database table that I want to index using dbmon-tail based on the commit time column. If I have multiple rows that have the same commit timestamp can I get into a situation where some rows won't be indexed if, for example, there is a network disconnect between Splunk and the database?

For example, there are 10 rows all with the same batch commit timestamp but Splunk only got 3 of them before a disconnect occurred. When the connection is restored would Splunk only continue from the next newer timestamp, assuming that there is no other column that could be used as a rising column?

Is there any difference in behaviour in this case between v1 and v2 of DB Connect?

Cheers

0 Karma
1 Solution

jcoates_splunk
Splunk Employee
Splunk Employee

No, this is a standard risk of using time as the rising column. Some form of database change will be needed. Either add a unique Row ID column, or increase the resolution of the existing time column.

View solution in original post

jcoates_splunk
Splunk Employee
Splunk Employee

No, this is a standard risk of using time as the rising column. Some form of database change will be needed. Either add a unique Row ID column, or increase the resolution of the existing time column.

gwiley_splunk
Splunk Employee
Splunk Employee

Thanks, you've confirmed what I thought.

And there's no difference in behaviour between v1 and v2 in this regard?

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

That's correct.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...