Solved: Rising Column value? - Splunk Community

All Apps and Add-ons

What should be used as the Rising Column value? I'm using the preconfigured SQL query, but each query results in a full dump of the database.

1 Solution

Solution

Found out if you add the following to the end of each query, it works.

AND "EVENTS"."EVENT_TIME_UTC" >?
ORDER BY "EVENTS"."EVENT_TIME_UTC" ASC

View solution in original post

Solution

Found out if you add the following to the end of each query, it works.

AND "EVENTS"."EVENT_TIME_UTC" >?
ORDER BY "EVENTS"."EVENT_TIME_UTC" ASC

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Tiling

This puzzle (first published here) is based on finding groups of tessellated tiles (inspired by floor tiles I ...

SOK it to Me: Top 3 Benefits of Using Splunk Operator on Kubernetes that’ll Make ...

Thursday, July 9, 2026 | 11:00AM–12:00PM PDT Duration: 1 hour (includes Q&A) Managing can feel like a ...

Upgrade Prep for 10.4, Network Observability Deep Dives, and More from Splunk Lantern

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...