Hi there,
i'm using Splunk Enterprise 7.0.3 and Splunk DB Connect 3.1.3.
i have this Data Lab Output configuration using real time saved search to export Splunk logs to a MySQL DB and it's working just fine until recently. What i'm experiencing now is the DB connect doesn't export some of the data from Splunk to DB (some of it is missing from the DB).
The issue is resolved when i'm using scheduled search with cron schedule but i'd like to use real time saved search again if possible. I hope i can get a solution.
Thanks in advance.
EDIT: i forgot to tell you that the Data Lab Output actually stopped exporting from Splunk Log at all approximately 2 weeks ago and i changed the real time saved search timerange from all time real time to all time 15 minute window and then it works again but the issue i explained in the beginning happens.
