Solved: Rising Column value? - Splunk Community

All Apps and Add-ons

What should be used as the Rising Column value? I'm using the preconfigured SQL query, but each query results in a full dump of the database.

1 Solution

Solution

Found out if you add the following to the end of each query, it works.

AND "EVENTS"."EVENT_TIME_UTC" >?
ORDER BY "EVENTS"."EVENT_TIME_UTC" ASC

View solution in original post

Solution

Found out if you add the following to the end of each query, it works.

AND "EVENTS"."EVENT_TIME_UTC" >?
ORDER BY "EVENTS"."EVENT_TIME_UTC" ASC

Get Updates on the Splunk Community!

Supercharging Windows Security Detection Performance: Introducing Hybrid Field ...

Windows event logs—from Security auditing and Sysmon to PowerShell script blocks—form the operational backbone ...

Enriching Signals with the OTel Lookup Processor

Introduction Raw telemetry is often incomplete. A log line might record an IP address, but what you really ...

Meet the .conf26 AI Agent Buildathon Winners

At the .conf26 AI Agent Buildathon, Splunk users turned their operational expertise into working AI agents ...