dbConnect restore deleted data

[nandipatisunil]

I had a database input which was getting data from a table.
I had to clean it up so that i can only get a subset of the columns.
So I deleted the records on Splunk by doing

sourcetype="dbmon..." | delete

after doing that i had removed the data i initially imported to splunk. however i see that that _internal index is still showing all those records. i am not sure how to clean up that.

Now my problem is ... when i try to chagne the query on my database input, though i save it ... i am not able to get the data back into splunk. Any help would be appreciated.

[aelliott · Accepted solution]

i usually clone the database input and the data goes back in, and disable (or delete) the old after you do.

[aelliott]

Yeah it is a bug per araitz reply above

[laiyongmao]

I met the same problem as you, I think someone said setting a time stamp, but I think it is a bug.if you know please tell me how you solved it, thank you.

http://answers.splunk.com/answers/114009/dbconnect-update-data-error

[araitz]

Yeah, there is a known issue with the app (DBX-281) where there is a caching mechanism implemented in Java which becomes out of sync with splunkd. We are working on how to solve this problem, but for now the workaround in this answer is the best path.