Database Inputs - Importing Data from SQL to Splunk problem

[Vijaikanth]

I have three columns in my SQL table "tblAudit"

Id SQL query ExecutedTime
1 select * from xxx where x= y Jan 1, 2016
2 Insert table xxx (select ....) Jan 30, 2016
3 Delete table.. Create trigger Jan 31, 2016

Now i need to input these details to splunk. Now Database Inputs >> Dump >> Specify SQL query >> Select * from tblAudit >> Save

Instead of 3 events there are 10 events displaying in Splunk and the problem is due to the column "SQL Query". It split the events somehow not sure if it is due to sql keywords and make it as 10 events. If the column "SQL Query" was not included in dump, it return exact 3 events. What is the problem here?

Tat column "SQL Query" is nVarchar(4000) in sql server.

[Vijaikanth · Accepted solution]

In my case, Splunk Split one event into multiple events because of the following parameter in props.conf

LINE_BREAKER = (\r\n)

So i removed the "\r\n" combination in the sql column by executing the below query in SQL table

/** Remove Carriage return and Line Feed **/
UPDATE ProblemTable
SET ProblemColumn = REPLACE(ProblemColumn, char(13), ' ' )

UPDATE ProblemTable
SET ProblemColumn = REPLACE(ProblemColumn, char(10), ' ' )

After corrected the SQL server column values, Splunk not created any multi level events and data loaded correctly.

[Vijaikanth]

Sample SQL Query Failing :
select * from xx s inner join xy d on s.id = d.id where s.code = 'Y' and s.desc = 'N' and s.total = 2 order by d.date desc