Splunk DB Connect: If I update or delete an entry from the database, does this change reflect in the sourcetype?

[nquba]

I am testing Splunk DB Connect for various conditions. So far my understanding is it can only detect and add an input to Splunk if a new entry is 'added' to the database and rising column (or checkpoint column in advance) is set for for that entry.

For cases where entries of database is updated or deleted, that doesn't reflect Splunk sourcetype. So to elaborate, if I update/delete an entry from the database the next run of Splunk DB Connect wouldn't show any change in the sourcetype where it is configured to input db data. Am I right or missing something? -Thanks

[martin_mueller · Accepted solution]

That is correct. When indexing data into Splunk, there is no update or delete operation.