Archive

Splunk DB Connect: Why did my dbmon-tail input to fetch data from a SQL query stop tailing data after 1 day?

Path Finder

Hi,

I have setup a dbmon-tail to fetch data from a SQL query every 15 minutes. It works as expected for a day until night, and suddenly the next day it stops tailing data.

Select * from ArcUnion {{WHERE $rising_column$ > ?}}

In the interval I have set as 15m.

Can you please tell me what's the issue here?

0 Karma

Path Finder

Have you also tried to change the interval to cron expression ?

0 Karma

Communicator

Does your dbx.log report anything related to an error? You may want to check that log instead of splunkd.log to start the troubleshoot process.

0 Karma

New Member

the "Rising Column" Timegenerated, is it like (or is) Unix Epoch, ever increasing or it is time of day, resetting to a lower value nightly ? Remember the query is looking for records where the value of Timegenerated is > (greater than) any value seen before.

Just checking the simple things

0 Karma

Path Finder

Rickamva,
Thanks for the response.
Timegenerated coloumn is ever increasing value, its a unix timestamp field which keeps on changing at any point of time.

0 Karma

Splunk Employee
Splunk Employee

try to use the full jdk installation from Oracle.

0 Karma

Path Finder

what do you meany by that ? you want me upgrade the DBX app ?

0 Karma

Contributor

Could you please paste your inputs.conf and did you check your splunkd.log for errors?

0 Karma

Path Finder

Hi ,

Below is my inputs.conf...

[dbmon-tail://Essmon_wnpcpdbeso01/ESO_DB_wnpcpdbeso01]
host = wnpcpdbeso01
index = eso
interval = 15m
output.format = mkv
output.timestamp = 1
output.timestamp.column = Timegenerated
query = Select * from ArcUnion {{WHERE $rising_column$ > ?}}
table = ESO_DB_wtpcpdbeso04
tail.rising.column = Timegenerated
disabled = 0

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!