Solved: Re: Rising Column value? - Splunk Community

All Apps and Add-ons

What should be used as the Rising Column value? I'm using the preconfigured SQL query, but each query results in a full dump of the database.

1 Solution

Solution

Found out if you add the following to the end of each query, it works.

AND "EVENTS"."EVENT_TIME_UTC" >?
ORDER BY "EVENTS"."EVENT_TIME_UTC" ASC

View solution in original post

Solution

Found out if you add the following to the end of each query, it works.

AND "EVENTS"."EVENT_TIME_UTC" >?
ORDER BY "EVENTS"."EVENT_TIME_UTC" ASC

Get Updates on the Splunk Community!

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Picture this. You arrive at .conf26 already having your socializing and networking plans mapped out. No ...

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

Implementing Zero Trust (ZT) across complex environments often falters at the very beginning due to a ...