All Apps and Add-ons

Splunk DB Connect: How does the approval_flag impact the output of the rising column?



I've been working with Splunk's DB Connect App for a few weeks and I have a question regarding the rising column. I'm attempting to only pull records that have been approved (weekly) so I have my SQL's WHERE clause structured similar to this:

WHERE approval_flag=1 AND rising_column > ?
ORDER BY rising_column

My question is this - will the rising column be updated to the most recent event regardless of an approval flag (or other condition)?

The reason I ask this question is because I noticed certain information missing during the weeks I tested a rising column solution. The information pertains to employee hours, and hours are approved by supervisors. Since there are multiple supervisors, hours are approved at different times. I'm wondering if the rising column will update to the most recent event, even if it isn't approved, perhaps leaving out events that were once unapproved but later approved.

This is all based on a hunch because I haven't found a lot of documentation on this particular subject of rising column. Thanks for any information/tips that may come!

-James M

0 Karma


Correct. Your rising column value will be updated if any results are found. So say you have 10 records, and the rising column value is 1-10, and all the approval_flag values are set to zero. The first time the input runs, it will return no results. If someone then sets the approval flag to 1 for records 1, 6 and 8, the input will retrieve Those three records your rising column value will now be 8. Then the next time the input runs the query will be

WHERE approval_flag=1 AND rising_column > 8 ORDER BY rising_column

Values of rising_column less than 8 will never be retrieved, even if their approval flag changes to 1.

0 Karma
Get Updates on the Splunk Community!

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...