splunk DB connect Execution Frequency

[pipipipi]

Hello.

I'm a bigginer splunk.
I have a question about splunk DB connect.
I can not understand Execution Frequency.
I want to get data for the past 7 days from DB.

I think Execution Frequency is time to access data, but I can't understand what range of data is taken.
for example, If I set Execution Frequency at 0 10 * * *, I think range of data is only 10a.m that day.
I need last 7 days data.

Counld you please help me for understanding this ?

[inventsekar · Accepted solution]

The execution frequency is something else, i think.
Execution Frequency: The number of seconds or a valid cron expression i.e. 0 18 * * * (every day at 6PM).

for your issue, add a where clause to your select statement that specifies a timestamp field past week only.
Presumable you could use some sql date function to make the calculation on the fly vs. having to hard code an actual date/time value.
where TIMESTAMP >= '2017-01-01 00:00:00'

If you only need to do it once, then set it up, let it run, and then disable it.
Otherwise, it will run every time execution frequency time passes.

[harsmarvania57]

Hi,

Execution frequency means Splunk will run same Database Query on Database and will fetch the result at scheduled intervals.

If you want to fetch only last 7 days data from Database then you need to include that timeframe in your Database Query if you have any timestamp column in Database table, otherwise it is difficult.