Are you a member of the Splunk Community?
- Find Answers
- :
- Apps & Add-ons
- :
- All Apps and Add-ons
- :
- Re: How to change the Checkpoint Value in a Splunk...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi all,
How to change the Checkpoint Value in a Splunk DB Connect 2 input for rising column?
Current Checkpoint value=2023-10-04 09:53:43.0, it's not indexing any events.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Go to $SPLUNK_HOME/etc/apps/splunk_app_db_connect/defaults/inputs.conf, and look for tail_rising_column_checkpoint_value. You can either remove that line altogether or change the timestamp to some other value. Note that this may re-index records you may have already indexed, unless you delete them from Splunk first. If you don't see the checkpoint value under the default folder, then look under local. You may need to restart Splunk after updating inputs.conf.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Go to $SPLUNK_HOME/etc/apps/splunk_app_db_connect/defaults/inputs.conf, and look for tail_rising_column_checkpoint_value. You can either remove that line altogether or change the timestamp to some other value. Note that this may re-index records you may have already indexed, unless you delete them from Splunk first. If you don't see the checkpoint value under the default folder, then look under local. You may need to restart Splunk after updating inputs.conf.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Its changing again once it ran.. How to solve this issue
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It always updates with the timestamp of the last record it indexed, so it knows where to pick up when new records are added to the database. Also, I just noticed that the timestamp in your example has 2023 for the year. If new records are added to your database with a year less than that (i.e. 2016) they won't get indexed.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is this the issue with query?
Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...
Splunk Observability for AI
🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler
