All Apps and Add-ons

On what conditions does Splunk DB Connect reset the rising column value in Persistent Storage?

Hi Experts,

I am using Splunk DB Connect installed on a heavy forwarder to monitor database using a rising column. I need to make some minor changes to the query to tune it for faster execution. Need to understand how Splunk DB Connect identifies the folder name, the current value of rising column is stored? I am worried that when the query is changed, Splunk might detect the change and would ignore the current rising column value and would run the query without rising column [for the first time after the change] This might create a new folder to store the current value under var/lib/splunk/persistentstorage/dbx folder and would use the new value. This would result in lot of duplicate values that would have got already indexed so far.

Need a confirmation on whether we can edit/change the query without impacting the current persistent value of rising column. Please note that there are no changes to the rising column name. The only change is to add some hints and where condition to the existing query.

The current version of db connect I am using is version 1.1.6.
The current state of persistent storage is given below. Variable values are marked with << >> with dummy values.

$SplunkFolder$/var/lib/splunk/persistentstorage/dbx/<<AutoGeneratedFolderName>>/manifest.properties

'# Created at < <DateTimeStamp> >
#<<DateTimeStamp>>
version=1
name=dbmon-tail\://<<MonitoringStanzaName>>
type=xstream
created=<<DateTimeNumber>>

$SplunkFolder$/var/lib/splunk/persistentstorage/dbx/<<AutoGeneratedFolderName>>/state.xml
<list>
  <value key="<<RaisingColumnName>>">
    <value class="sql-timestamp"> <<Latest Value of Raising Column FromLast Run>></value>
  </value>
</list>
0 Karma

Splunk Employee
Splunk Employee

I don't remember the answer for DBX version 1, but DB Connect 3 allows you to update the query without resetting the checkpoint.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!