I tried to use timestamp as "rising column" but it didnt work.
when input type = Rising
Can you please try formatting TXTIME as epoch format?
After changing to Rising mode you have to execute query once. Then you should update your query with where clause. Most probably error reason is checkpoint "?" variable has no value yet.
If that does not work you can update checkpoint value with a valid time value from your results.
Thanks for you reply, it doesn't work. When changing to Rising mode, Splunk need filter the rising column with a WHERE statement and sort the results with ORDER BY. "java.sql.SQLException: Invalid column index"