All Apps and Add-ons

Configuring Azure Table Storage App in SPlunk

brent_weaver
Builder

I am trying to setup Azure Table storage logs. There is a field I do not know how to populate:

Date/Time Column *
A date/time column to use for checkpointing and quering for new data.

Does anyone have any idea what I put there? I cannot find anything in documentation about it.

Thanks!

0 Karma
1 Solution

jconger
Splunk Employee
Splunk Employee

For generic table data, we need to know which column to use as to check for new data. Each time the input runs, we get all the data we can and then write to disk the last time stamp read from the returned results (this is called checkpointing). The next time the input runs, we read this value and pick up where we left off. Most of the time, this will be the Timestamp column. But, you can use any column you want for this logic.

View solution in original post

0 Karma

jconger
Splunk Employee
Splunk Employee

For generic table data, we need to know which column to use as to check for new data. Each time the input runs, we get all the data we can and then write to disk the last time stamp read from the returned results (this is called checkpointing). The next time the input runs, we read this value and pick up where we left off. Most of the time, this will be the Timestamp column. But, you can use any column you want for this logic.

View solution in original post

0 Karma

brent_weaver
Builder

Timestamp worked perfectly, thank you!

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!