splunk Dbconnect - index issue

[DataOrg]

i have 2 fields with open _issue_timestamp and closed_issue_issue.
when the ticket is opened the time will be updated in opened_issue and once action is taken the timestamp will be updated in closed_issue column later point of time.
so if we configure DB_input using ID it will not capture the closed_issue column when a new Ticket is opened ?
how to over come this issue?

[nickhills · Accepted solution]

For updated rows to be processed by DBX you need a rising column value which changes whenever the row is updated.

Commonly, databases may have an "updated" column in which the timestamp or an incremental unique ID is modified whenever any other column in that record is amended.
If you have such a field in your database, you should use this value as the rising column, and sort the table results by "updated".

If your database does not have such a column, your choices are:
Have it introduced by the developers/dba
Use a batch process to import rows on a schedule - in many cases this will likely lead to some data duplication, so you will need to deduplicate, or otherwise handle this in Splunk

https://docs.splunk.com/Documentation/DBX/3.2.0/DeployDBX/Createandmanagedatabaseinputs