All Apps and Add-ons

Splunk DB Connect output issue when using real time saved search


Hi there,

i'm using Splunk Enterprise 7.0.3 and Splunk DB Connect 3.1.3.

i have this Data Lab Output configuration using real time saved search to export Splunk logs to a MySQL DB and it's working just fine until recently. What i'm experiencing now is the DB connect doesn't export some of the data from Splunk to DB (some of it is missing from the DB).

The issue is resolved when i'm using scheduled search with cron schedule but i'd like to use real time saved search again if possible. I hope i can get a solution.

Thanks in advance.


EDIT: i forgot to tell you that the Data Lab Output actually stopped exporting from Splunk Log at all approximately 2 weeks ago and i changed the real time saved search timerange from all time real time to all time 15 minute window and then it works again but the issue i explained in the beginning happens.

Labels (1)
Tags (1)
Get Updates on the Splunk Community!

Platform Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestIntroducing Splunk Edge Processor, simplified data ...

Enterprise Security Content Updates (ESCU) - New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 3 releases of new content via the Enterprise ...

Thought Leaders are Validating Your Hard Work and Training Rigor

As a Splunk enthusiast and member of the Splunk Community, you are one of thousands who recognize the value of ...