All Apps and Add-ons

why the splunk index is not pulling data properly from warehouse

New Member

Hi ,
Our way is to pull data from sql view to splunk through dbconnect.
The splunk inded is not pulling the data available in view properly into splunk index.ex-when there is more than 30k rows in views , a particular field is showing very minimum rows like 4k only, but the total count of index matches with the view as 30 k.

My question here is why a particular field gets minimum entries .I have recreated the index after deleting the old one ,but still facing the same issue .

Please help me with solution.

0 Karma

Esteemed Legend

Is this v2? If so, Splunk HARD-CODED an arbitrary limit into Here is another Q&A that shows how to bypass it:
Other than that, check the dbx2.log (not automatically splunked):

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!