I use DBconnect, when I update the data in the database, a fault occurs, the inside of the Splunk display information and database display different.i think it is a bug..
In the database.
mysql> update updatetest set ID=ID+1;
mysql> select * from updatetest;
+------+------+
| ID | name |
+------+------+
| 2 | jim |
| 3 | anny |
+------+------+
2 rows in set (0.00 sec)
on my splunk
search index=updatetest
13-12-5 下午07时12分19.000秒 id=3 name=anny
host = localhost source = dbmon-tail://updatetest/updatetest sourcetype = updatetest
13-12-5 下午07时07分05.000秒 id=2 name=anny
host = localhost source = dbmon-tail://updatetest/updatetest sourcetype = updatetest
13-12-5 下午07时07分05.000秒 id=1 name=jim
host = localhost source = dbmon-tail://updatetest/updatetest sourcetype = updatetes
I don't know why, I hope someone can help me
After creating an entry via either dbmon-dump or dbmon-tail inputs,
deleting the entry or creating a new entry does not remove the data from
the internal_index. This is due to a state caching issue. Workaround:
Clone the database input, then disable (or delete) the old input. (DBX-281)
After creating an entry via either dbmon-dump or dbmon-tail inputs,
deleting the entry or creating a new entry does not remove the data from
the internal_index. This is due to a state caching issue. Workaround:
Clone the database input, then disable (or delete) the old input. (DBX-281)
Have to find a solution.