Splunk DB Connect: How does the approval_flag impact the output of the rising column?

[jamesmoriarty]

Hello!

I've been working with Splunk's DB Connect App for a few weeks and I have a question regarding the rising column. I'm attempting to only pull records that have been approved (weekly) so I have my SQL's WHERE clause structured similar to this:

WHERE approval_flag=1 AND rising_column > ?
ORDER BY rising_column

My question is this - will the rising column be updated to the most recent event regardless of an approval flag (or other condition)?

The reason I ask this question is because I noticed certain information missing during the weeks I tested a rising column solution. The information pertains to employee hours, and hours are approved by supervisors. Since there are multiple supervisors, hours are approved at different times. I'm wondering if the rising column will update to the most recent event, even if it isn't approved, perhaps leaving out events that were once unapproved but later approved.

This is all based on a hunch because I haven't found a lot of documentation on this particular subject of rising column. Thanks for any information/tips that may come!

-James M

[jplumsdaine22]

Correct. Your rising column value will be updated if any results are found. So say you have 10 records, and the rising column value is 1-10, and all the approval_flag values are set to zero. The first time the input runs, it will return no results. If someone then sets the approval flag to 1 for records 1, 6 and 8, the input will retrieve Those three records your rising column value will now be 8. Then the next time the input runs the query will be

WHERE approval_flag=1 AND rising_column > 8 ORDER BY rising_column

Values of rising_column less than 8 will never be retrieved, even if their approval flag changes to 1.