All Apps and Add-ons

splunk Dbconnect - index issue

premranjithj
Builder

i have 2 fields with open _issue_timestamp and closed_issue_issue.
when the ticket is opened the time will be updated in opened_issue and once action is taken the timestamp will be updated in closed_issue column later point of time.
so if we configure DB_input using ID it will not capture the closed_issue column when a new Ticket is opened ?
how to over come this issue?

0 Karma
1 Solution

nickhills
Ultra Champion

For updated rows to be processed by DBX you need a rising column value which changes whenever the row is updated.

Commonly, databases may have an "updated" column in which the timestamp or an incremental unique ID is modified whenever any other column in that record is amended.
If you have such a field in your database, you should use this value as the rising column, and sort the table results by "updated".

If your database does not have such a column, your choices are:
Have it introduced by the developers/dba
Use a batch process to import rows on a schedule - in many cases this will likely lead to some data duplication, so you will need to deduplicate, or otherwise handle this in Splunk

https://docs.splunk.com/Documentation/DBX/3.2.0/DeployDBX/Createandmanagedatabaseinputs

If my comment helps, please give it a thumbs up!

View solution in original post

0 Karma

nickhills
Ultra Champion

For updated rows to be processed by DBX you need a rising column value which changes whenever the row is updated.

Commonly, databases may have an "updated" column in which the timestamp or an incremental unique ID is modified whenever any other column in that record is amended.
If you have such a field in your database, you should use this value as the rising column, and sort the table results by "updated".

If your database does not have such a column, your choices are:
Have it introduced by the developers/dba
Use a batch process to import rows on a schedule - in many cases this will likely lead to some data duplication, so you will need to deduplicate, or otherwise handle this in Splunk

https://docs.splunk.com/Documentation/DBX/3.2.0/DeployDBX/Createandmanagedatabaseinputs

If my comment helps, please give it a thumbs up!

View solution in original post

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!