Splunk DB Connect: How to create new DB Inputs?

[aniello_cerrato]

Hi,

I am trying to create a new DB input on Splunk DB Connect. I have to schedule the search every one hour (that gets the data changed in the last hour) but when I create the input the search, it returns zero records and I can't proceed to create db inputs.

Do you have a solution to create db inputs if the relative search returns no records?

Thanks,
Aniello

[earlhelms]

I have had the same issue countless times. The only work around that I've came up with is to modify the search to add a record. Typically when modifying an existing input, I roll back the rising column by 1 and add the last record again as a duplicate entry.