Getting Data In

DBX Rising Column Field Reverting to previously used Field Value after one query

New Member

I'm having an issue with DBX where I'm trying to change an existing input or create a new input (I've attempted both) to change the field I'm using for the rising column. I've been using a date/time field for rising column out of necessity but we recently added a proper rising column field to the table that I'd like to switch to.

The problem I'm running into is every time I switch to the new ID column from the EventDateTime column, the DBX input queries the data once with the new ID value and then appends the latest EventDateTime value into the rising column log. The ID field remains in the configuration but the input is now broken because the rising column value reverted.

2021-02-18 14_35_29-Window.png

This happens whether or not I'm re-using the old Input or if I create a completely new input from scratch. I AM attempting to use the existing custom source and sourcetype information so I don't have to edit my 20+ dashboards and many more field extractions. If anyone has any thoughts on this I'd greatly appreciate the feedback!



Labels (1)
0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...