All Apps and Add-ons

DBXConnet 3.1.1 losing some of the rows - troubleshooting

piotrgalas
Explorer

Hello,

I have a situation where I have an input that is losing some of the rows. The connection works stable. The input is executed every 5 minutes and defined with rising column on “LASTMODIFIED” (DateTime) column with ">=?" to avoid lost rows, order ASC. Vast majority of rows is indexed correctly but few are not. Interestingly when I use SQL Explorer I retrieve the rows without any problem. I have created special input that was 100% the same as the original one + had “and ID=123” in SQL query limiting the ingest to the one of the interesting rows only. It worked like charm. Answering question before asked – I cannot use any different column to be rising one (hence “>=” not the typical “>” in SQL query). Moreover, I have checked and found out that the missing “123 row” has no twin row with the same “LAST MODIFIED” value.
1. I am looking for ways of troubleshooting it. I tried to increase logging to DEBUG but I drown in the amount of logs and was unable to find anything that would be helpful in the obvious way – I was hoping for results of each row parsing, no luck…
2. If anyone can suggest possible causes that are not covered by “>=” trick I would also truly appreciate.

Thank you in advance 🙂

0 Karma
Get Updates on the Splunk Community!

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Want a chance to win $500 to the Splunk shop? Take our IT Incident Management Survey!

  Top Trends & Best Practices in Incident ManagementSplunk is partnering up with Constellation Research to ...