All Apps and Add-ons
Highlighted

Splunk DB Connect: Is it possible to clear all rows in database and add all results (old and new) for every execution?

Contributor

Hi,
I have to send results to the database from Splunk using Splunk DB Connect. But in documentation it is given that for every execution only the updated results will added to database table.
Is it possible to clear all rows in database and add all results (old and new) for every execution?

0 Karma
Highlighted

Re: Splunk DB Connect: Is it possible to clear all rows in database and add all results (old and new) for every execution?

Legend

Hi ankithreddy777,
using DB Connect you can acquire records in two ways:

  • all query results;
  • only newest records. you can choose the preferred Input Type in the creation of database input (see http://docs.splunk.com/Documentation/DBX/2.4.0/DeployDBX/Createandmanagedatabaseinputs#Choose_and_pr...) If you choose "batch input" you take all the times all the query's results, if you choose "Rising column" you have to choose a field, always growing, to use to record the check point (Splunk records in a configuration file the last value of the rising column from the executed query and uses it as starting point for the next one). There is also a third choose ("Advanced") similar to "Rising column". Bye. Giuseppe
0 Karma
Highlighted

Re: Splunk DB Connect: Is it possible to clear all rows in database and add all results (old and new) for every execution?

Contributor

Hi Cusello,
How to send all results to the database for every execution. Instead of only new results using database. Can we delete results in database?

0 Karma
Highlighted

Re: Splunk DB Connect: Is it possible to clear all rows in database and add all results (old and new) for every execution?

Legend

No the "Batch input" option permits to download all the results of a query, but it doesn't delete records from DB, it's possible but you have to grant deletion privileges to the user that you use to connect to your DB (it isn't a usual procedure!) and create another DB script to delete the downloaded records.

Why you don't want to use the "Rising column" method? it's really more efficient!
If the problem is that you have rotation of your DB (in this way your rising column will be reset at every file rotation), you can manage this situation in an easy way:

  • add to your query an additional field resulting by timestamp + growing code
  • use this new field as rising column. In this way your rising column will be always growing.

Bye.

Giuseppe

0 Karma
Highlighted

Re: Splunk DB Connect: Is it possible to clear all rows in database and add all results (old and new) for every execution?

Esteemed Legend

You are probably aware that you have posted this question twice, right?

https://answers.splunk.com/answers/494339/delete-database-results-and-update-with-new-result.html#an...

0 Karma