All Apps and Add-ons

DB Connect - Data Input Query and Error Received of - DB Input definition cannot continue with an empty table in Rising Column mode

EmEdwards
Path Finder

I'm new to using Splunk so please could someone clarify this issue for me.
I added data using DB connect to a SQL Server view.
The first time I added a Data Input I used Batch Input as my selection of Data which is a list of people lets say....
On later querying this data is Search and Reporting I had numerous duplicates for Individuals which messed up my result set.
So I tried a new Data Input using a Rising column of a unique primary key of PeopleID for example.

Today on checking the Data Input has not added any NEW records and is displaying an error of
DB Input definition cannot continue with an empty table in Rising Column mode

The Rising Column is a Primary Key and does not contain any empty values in source.
On running the view it's connecting to there are new records which have not been added.

Please can someone explain how I use a Data Input that will add new records or updated records ?

Thanks

0 Karma

EmEdwards
Path Finder

Hi, this post was some time back. To be honest I ended up going back to an older version of DBX and this resolved the problem I had.
In the older version I use at the moment I only have a select on the table as the query with no where clause or order by needed, then in the UI you specify the rising column from a drop down field and DBX does the rest.
In the newer versions I think I tested removing the order by clause and this too made a difference. Good luck.

0 Karma

EmEdwards
Path Finder

Oh and sorry the query I'm using for DB connect and the rising column looks a bit like this example ;

SELECT *
FROM "Utilities"."dbo"."People"
Where PeopleID >?
ORDER BY PeopleID asc

0 Karma

wsmworkhard
Explorer

I have the same issue. And my SQL query looks like yours (Date>? ORDER BY Date asc)
Does this happen because no PeopleID greater than current checkpoint value found in database? (no more data in DB)

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Index This | What travels the world but is also stuck in place?

April 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Realizing the full potential of your Splunk investment requires more than just understanding current usage; it ...

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...

As data volumes continue to grow and environments become more distributed, managing and optimizing data ...