All Apps and Add-ons

On what conditions does Splunk DB Connect reset the rising column value in Persistent Storage?

rabindrakumarpa
Explorer

Hi Experts,

I am using Splunk DB Connect installed on a heavy forwarder to monitor database using a rising column. I need to make some minor changes to the query to tune it for faster execution. Need to understand how Splunk DB Connect identifies the folder name, the current value of rising column is stored? I am worried that when the query is changed, Splunk might detect the change and would ignore the current rising column value and would run the query without rising column [for the first time after the change] This might create a new folder to store the current value under var/lib/splunk/persistentstorage/dbx folder and would use the new value. This would result in lot of duplicate values that would have got already indexed so far.

Need a confirmation on whether we can edit/change the query without impacting the current persistent value of rising column. Please note that there are no changes to the rising column name. The only change is to add some hints and where condition to the existing query.

The current version of db connect I am using is version 1.1.6.
The current state of persistent storage is given below. Variable values are marked with << >> with dummy values.

$SplunkFolder$/var/lib/splunk/persistentstorage/dbx/<<AutoGeneratedFolderName>>/manifest.properties

'# Created at < <DateTimeStamp> >
#<<DateTimeStamp>>
version=1
name=dbmon-tail\://<<MonitoringStanzaName>>
type=xstream
created=<<DateTimeNumber>>

$SplunkFolder$/var/lib/splunk/persistentstorage/dbx/<<AutoGeneratedFolderName>>/state.xml
<list>
  <value key="<<RaisingColumnName>>">
    <value class="sql-timestamp"> <<Latest Value of Raising Column FromLast Run>></value>
  </value>
</list>
0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

I don't remember the answer for DBX version 1, but DB Connect 3 allows you to update the query without resetting the checkpoint.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>