How do I set up Splunk DB Connect so I only get new log information every time I do a query instead of pulling the whole

[dennislevine]

How do I set up Splunk DB Connect so I only get new log information every time I do a query instead of pulling the whole database each time?

I've got the connection working and I'm getting data in, but every time the input runs it pulls the entire database again instead of just pulling in the newest data. How do I limit what it pulls?

[richgalloway]

Use a Rising input.  This is where DBX keeps track of the last value seen for a specific field so subsequent queries can fetch newer values.

See https://docs.splunk.com/Documentation/DBX/3.18.1/DeployDBX/Createandmanagedatabaseinputs#Choose_inpu... for details.