All Apps and Add-ons

Rising column not working with Netezza connection

patouellet
Path Finder

Hi,

First I just want to say we are using DB Connect and DB Inputs with Rising columns extensively with DB2, Oracle and SQL Server database types - all without issues.

But recently we've been trying to setup a DB Input with Netezza database and the rising column is not working - not doing what it's supposed to be doing. I have a DB Input setup to run every 5 minutes and it pulls the same record everytime. Looking at the TIME column I am using as a rising column, and the checkpoint value Splunk DBConnects uses, it looks like the checkpoint value isn't precise enough to make the where statement work as intended.

The query is:

 SELECT * 
    FROM "HISTDBV3"."HISTUSR"."$hist_failed_authentication_3"
    WHERE TIME > ?
    ORDER BY TIME ASC

The value of the TIME column is:

2020-03-10 19:34:04.884102

The checkpoint value is (according to the Edit Input interface):

3/10/2020 19:34:04.884

So of course if with statement "WHERE TIME > ?" then it is always true (19:34:04.884102 > 19:34:04.884).

Looks like a bug to me. Anyone experienced this?

Thanks.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Rounding off the Splunk Dashboard Contest

What does a contest-winning Splunk dashboard look like? In this case, it isn't in a browser tab at all. It ...

A Four Part Event Series: AI + Observability: AI Agents, LLMs, Apps, & Infrastructure

AI + Observability: AI Agents, LLMs, Apps, & Infrastructure The rapid evolution of artificial intelligence ...

Splunk Technical Support Is Moving to Cisco Support Tools

Introduction Splunk technical support is transitioning to Cisco’s support environment. This change brings ...