All Apps and Add-ons

Splunk DB Connect: Why is data being lost when connecting to a MSSQL server?

cpuppet
Path Finder

My Splunk DB Connect seems to have some data lost issue connecting to a MSSQL server where the DB is used as customer service loggings.
Has anyone face the same problem while tailing a datetime column and missing a few rows comparing data in Splunk and database?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This is why Splunk cautions against using timestamp/datetime as a rising column. Once DB Connect reads a set of rows, it asks for a new set consisting of rows with datetime column values greater than the value last read. Any rows written to the DB with the rising column value since the last read will be skipped.

Have you checked the datatime values of the lost rows?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...