All Apps and Add-ons

DB Connect ignoring rising column and pulls all rows after initial checkpoint value for every query.

att35
Builder

Hi,

I am using DB Connect V2(Configured on Indexer) to pull data from MSSQL Database with timestamp as the Rising Column. Data in the preview looks good but once the input is saved, each query pulls everything from the checkpoint timestamp onward instead of pulling only the rows that were added after the last updated checkpoint.

SELECT COLUMN1,
         COLUMN2,
         COLUMN3,
         COLUMN4,
         TIMESTAMP
FROM <Table_Name>
WHERE TIMESTAMP > ?
ORDER BY  TIMESTAMP DESC

alt text

Is there anything else I am missing in the configuration?

~ Abhi

0 Karma

Richfez
SplunkTrust
SplunkTrust

Shouldn't those be

ORDER BY <checkpointfieldname> ASC

?

I'd have to whip open my own DB connect to confirm, but hopefully that's all this is.

0 Karma

att35
Builder

To test, I edited the checkpoint value manually and set it to the current time. After saving, the input started working properly and checkpoint was getting updated with the latest data but after a while it again went back to the old checkpoint value I had set.

0 Karma

vsingla1
Communicator

@abhijittikekar I am also facing the same issue. Did you get a solution to your issue?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...