Splunk DB Connect Inserting Multiple Rows

[kywolf]

We have a DB Output setup to work off of the below search. The result from the search should be 1 row.

When the job runs (every 5 minutes) it inserts multiple rows into the external database table. It looks like it collects search result data as it's going through the indexed files and then inserts it all at once.

How can I limit this to only insert one row after the job has completely finished?

example search
index=network sourcetype=example "/uri/index*" earliest=-5m@m latest=now | stats count(eval(NOT request_status="blocked")) as Unblocked, count(eval(request_status="blocked")) as Blocked | head limit=1

example table

id  timestamp      unblocked  blocked
80  2015-07-01 11:30:15  89405    3
79  2015-07-01 11:30:15  88069   1
78  2015-07-01 11:30:15  65787   1
77  2015-07-01 11:30:15  22380   0

We should be getting the bold row only.

[jcoates_splunk]

This sounds like it could be a bug, and is worth a support ticket. It is not expected to ignore your | head limit=1 statement.

[jklumpp_splunk]

Based on your question description it would appear to be a DB Connect question, but in looking at your search and your results that seems to be the odd part. Can you confirm that you used | head limit=1 and then received more than one result in the search?

[kywolf]

I agree, it is a DB Connect question. When I run that search in the Search & Reporting app, it returns 1 result. When I preview the result in the DB Output, it returns 1 line. When it runs on it's own, however, it inserts multiple rows.

Does anyone know of a DB Connect configuration option that could correct this?