I'm having an issue with DBX where I'm trying to change an existing input or create a new input (I've attempted both) to change the field I'm using for the rising column. I've been using a date/time field for rising column out of necessity but we recently added a proper rising column field to the table that I'd like to switch to.
The problem I'm running into is every time I switch to the new ID column from the EventDateTime column, the DBX input queries the data once with the new ID value and then appends the latest EventDateTime value into the rising column log. The ID field remains in the configuration but the input is now broken because the rising column value reverted.
This happens whether or not I'm re-using the old Input or if I create a completely new input from scratch. I AM attempting to use the existing custom source and sourcetype information so I don't have to edit my 20+ dashboards and many more field extractions. If anyone has any thoughts on this I'd greatly appreciate the feedback!
Thanks,
