All Apps and Add-ons

Splunk DB Connect: How to ingest only recent Oracle DB logs?

sshres5
Communicator

I am trying to ingest logs residing in Oracle DB through Splunk DB Connect (DB2), it dates back to couple of years. Currently it is only ingesting old logs, even though I have used a checkpoint value it doesn't seem to work.

I just want to ingest logs starting like a week ago.

0 Karma
1 Solution

sshres5
Communicator

So I got this working by manually appending the inputs.conf file's tail rising value and then using 'where' clause in the Rising column's SQL query.

View solution in original post

0 Karma

sshres5
Communicator

So I got this working by manually appending the inputs.conf file's tail rising value and then using 'where' clause in the Rising column's SQL query.

View solution in original post

0 Karma

sjohnson_splunk
Splunk Employee
Splunk Employee

Add a where clause to your select statement that specifies a timestamp field > a week ago. Presumable you could use some sql date function to make the calculation on the fly vs. having to hard code an actual date/time value.

0 Karma

sshres5
Communicator

So I tried using the where clause, getting error. Probably I am not using the function properly
where TIMESTAMP >= '2017-01-01 00:00:00'

"None", caused by: Exception(' java.sql.SQLDataException: ORA-01843: not a valid month\n.',). "

0 Karma

sshres5
Communicator

I was able to get the query right, however 0 rows returned.

where TIMESTAMP >= timestamp'2017-01-01 00:00:00'

0 Karma

jplumsdaine22
Influencer

What does your inputs.conf (in $SPLUNK_HOME$/etc/apps/splunk_app_db_connect/local/inputs.conf) look like?

0 Karma

sshres5
Communicator

tail_rising_column_checkpoint_value = 1340340698871

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.