I have configured and validated connections for the EPO DB. Everything works great, the query executes and returns data. The issue is that it seems to just sit at the earliest 10,000 results that are stored on the EPO side. I have changed the maximum amount of rows to the stated maximum of 1,000,000 per query and the query is a rising column and set to execute every 10 minutes but if I search the index I always just get the earliest 10,000 results no matter what.
Yeah the max_rows is set to 1,000,000 -- copied from the Mcafee TA template:
## DB Connect 2 Input Template Stanza ## [mi_input://ta_mcafee_epo_5_input] disabled = 0 connection = mcafee index = epo interval = * 10 * * * max_rows = 1000000 output_timestamp_format = YYYY-MM-dd HH:mm:ss sourcetype = mcafee:epo source = dbx mode = tail query = [truncated for splunk answers] tail_follow_only = 1 tail_rising_column_name = AutoID tail_rising_column_number = 2 ui_query_mode = advanced input_timestamp_column_name = timestamp input_timestamp_column_number = 1 tail_rising_column_checkpoint_value = 52764329
Update, today I logged in and there are now 19,000 results ( I have not changed anything, I did edit the Py script middle of last week to not have a hard coded value for max rows). However, it is still months behind what the data should be and I am not sure if this is all the results it should have for the time period it is returning.