Id SQL query ExecutedTime
1 select * from xxx where x= y Jan 1, 2016
2 Insert table xxx (select ....) Jan 30, 2016
3 Delete table.. Create trigger Jan 31, 2016
Now i need to input these details to splunk. Now Database Inputs >> Dump >> Specify SQL query >> Select * from tblAudit >> Save
Instead of 3 events there are 10 events displaying in Splunk and the problem is due to the column "SQL Query". It split the events somehow not sure if it is due to sql keywords and make it as 10 events. If the column "SQL Query" was not included in dump, it return exact 3 events. What is the problem here?
Tat column "SQL Query" is nVarchar(4000) in sql server.