All Apps and Add-ons

Splunk DB Connect: How to troubleshoot why I'm not getting any of my MS SQL data in Splunk?

New Member

I'm pretty new to Splunk so am configuring this with the help of the guides. I have configured the Splunk DB Connect 2 app to query a table in my MS SQL server.

Everything shows a valid connection when configuring the data input and the query returns data for me to configure it with. I have a rising column set and when checking the rpc.log, I can see the query running. In here, the query says

RisingColumnName > ? ORDER BY RisingColumnName ASC

of course replacing RisingColumnName with the actual column - I'm not sure if the ? is just something to do with Splunk or if this should in fact be the ID for the rising column?

Not sure what to look at now. I just can't get any of my data from SQL into SplunK!

0 Karma


The question mark is where the last-seen value of RisingColumnName is inserted by DB Connect when submitting the query. You must enclose the WHERE clause (or a subset of it) in double braces "{{}}" for it to work. Check dbx.log for errors.

If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf23 Registration is Now Open!

Time to toss the .conf-etti 🎉 —  .conf23 registration is open!   Join us in Las Vegas July 17-20 for ...

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...