All Apps and Add-ons

why the splunk index is not pulling data properly from warehouse

Sundardtcc
New Member

Hi ,
Our way is to pull data from sql view to splunk through dbconnect.
The splunk inded is not pulling the data available in view properly into splunk index.ex-when there is more than 30k rows in views , a particular field is showing very minimum rows like 4k only, but the total count of index matches with the view as 30 k.

My question here is why a particular field gets minimum entries .I have recreated the index after deleting the old one ,but still facing the same issue .

Please help me with solution.

0 Karma

woodcock
Esteemed Legend

Is this v2? If so, Splunk HARD-CODED an arbitrary limit into dbxquery.py. Here is another Q&A that shows how to bypass it:

https://answers.splunk.com/answers/233222/splunk-db-connect-2-dbxquery-only-returns-1001-row.html
Other than that, check the dbx2.log (not automatically splunked):

http://docs.splunk.com/Documentation/DBX/2.2.0/DeployDBX/Troubleshooting

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!