All Apps and Add-ons

Unable to configure an input on Splunk DB Connect 3.1.1 version using rising column input type.

bsriramineni_sp
Splunk Employee
Splunk Employee

I want to configure a db input to fetch data from MS-SQL server database. I want to use rising column input type. However, when I configure the input I am getting the below error

com.microsoft.sqlserver.jdbc.SQLServerException: The index 1 is out of range.

No results found.

Below is my SQL query:

SELECT * FROM "msdb" ."dbo"."MSdbms"
WHERE dbms_id > 2
ORDER BY dbms_id ASC

I am using db connect 3.1.1 app and MS-SQL Server using MS Generic Driver.

0 Karma
1 Solution

bsriramineni_sp
Splunk Employee
Splunk Employee

Solution:
Modify the query as below:

SELECT * FROM "msdb" ."dbo"."MSdbms"
WHERE dbms_id > ?
ORDER BY dbms_id ASC

Explanation:

You need to update the SQL query that includes a "?" symbol and order by clause for the checkpoint value. The question mark (?) as the checkpoint placeholder and an order by clause. Every time the input is run, DB Connect replaces the question mark with the latest checkpoint value .

Refer the below link:

https://docs.splunk.com/Documentation/DBX/3.1.1/DeployDBX/Createandmanagedatabaseinputs#Choose_input...

View solution in original post

bsriramineni_sp
Splunk Employee
Splunk Employee

Solution:
Modify the query as below:

SELECT * FROM "msdb" ."dbo"."MSdbms"
WHERE dbms_id > ?
ORDER BY dbms_id ASC

Explanation:

You need to update the SQL query that includes a "?" symbol and order by clause for the checkpoint value. The question mark (?) as the checkpoint placeholder and an order by clause. Every time the input is run, DB Connect replaces the question mark with the latest checkpoint value .

Refer the below link:

https://docs.splunk.com/Documentation/DBX/3.1.1/DeployDBX/Createandmanagedatabaseinputs#Choose_input...

Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...