All Apps and Add-ons

Query on how splunk indexes modified tables data from database.

bharathkumarnec
Contributor

How splunk identifies if there are any tables modified in database, so that it will remove duplicates?

Tags (1)
0 Karma

dwaddle
SplunkTrust
SplunkTrust

I'm going to make some assumptions.

You're talking about indexing data from a relational database using the Splunk DB-Connect app. When data in the database table(s) are modified, there is a timestamp column that is updated to show the row(s) modified have changed.

DB Connect is able to look for rows with an "updated timestamp" that is newer than its last check, and re-index the whole row. You WILL get duplicates. If the table has a usable primary key, then you could use the splunk dedup command to remove values of the primary key fields from your search, keeping only the newest one.

Does this help?

bharathkumarnec
Contributor

Yes..Thanks for your inputs...

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...