Configuring Azure Table Storage App in SPlunk

[brent_weaver]

I am trying to setup Azure Table storage logs. There is a field I do not know how to populate:

Date/Time Column *
A date/time column to use for checkpointing and quering for new data.

Does anyone have any idea what I put there? I cannot find anything in documentation about it.

Thanks!

[jconger · Accepted solution]

For generic table data, we need to know which column to use as to check for new data. Each time the input runs, we get all the data we can and then write to disk the last time stamp read from the returned results (this is called checkpointing). The next time the input runs, we read this value and pick up where we left off. Most of the time, this will be the Timestamp column. But, you can use any column you want for this logic.

[brent_weaver]

Timestamp worked perfectly, thank you!