DB connect query field need to create in splunk data

[rakesh44]

Hi Friends,

I have DB connect query which runs from 1 to 7th date of every month.

I need one field to be create in splunk data if query is run out of date from 1 to 7th of every month. Suppose query is re-run manually on 8th then it should create one field in splunk data. Could we create such automation in splunk

I required such arrangement as we are trying to compare count of data injected from database with count of data in splunk. I could not use date as field as data keep changing in mili seconds.

[lakshman239]

you could have a field say | eval query_runTime = _time in your search , which will populate the time and it can be stored in the index. everytime you run, you will have the time (including ms). would this not help?

[rakesh44]

There two things when DB connect query runs it pull data from oracle and put it in splunk Index.
In my case if DB connect query runs it should create one field in splunk Index. Then I would count no fields in splunk.