Splunk DB Connect setting up Rising column?

[Shan]

When i read the doc in below link. It advice's me not to choose the timestamps column as the rising columns, but in my scenario i have the lastupdate_datetime(2018/04/22 12:33:44:00) column as most frequently changing column and i need to use it as a rising column..

http://docs.splunk.com/Documentation/DBX/3.1.3/DeployDBX/Createandmanagedatabaseinputs

I have a columns as ticket_id, ticket_status, lastupdate_datetime .

Kindly guide me with your opinion.
Thanks in advance.

Regards,
Shankar

[Shan · Accepted solution]

I have used the datetime column as rising column and i achieved my need. It's working properly i have validated it.

[ssadanala1]

lastupdate_datetime is the best shot for rising columns .

As per the documentation

Rising input
A rising input has a column that DB Connect uses to keep track of what rows are new from one input execution to the next. When you create a rising input type, you must specify the rising column. You can specify rising column as any column whose value increases or decreases over time, such as a timestamp or sequential ID. For example, you can use columns such as row_id, transaction_id, employee_id, customer_id, last_updated, and so on.

[Shan]

@ ssadanala1 - Thanks for your Input.

[p_gurav]

Can't you used ticket_id?

[Shan]

@p_gurav - No i don't think so . That is a random generating id .. If use it there will be a problem in near feature..

[p_gurav]

ok. Can you use id then which is row every database provide?

[Shan]

Are you talking about row Id. now I'm looking into a ticketing data from database .. Once the ticket is created its stored as open in database. even after 3 days someone can work on that ticket at that time i might miss that ticket update i thick so. because i need to look into some old ticket updates also. correct me if my understanding is wrong ..