Getting Data In

How do I set up Splunk DB Connect so I only get new log information every time I do a query instead of pulling the whole

dennislevine
New Member

How do I set up Splunk DB Connect so I only get new log information every time I do a query instead of pulling the whole database each time?

I've got the connection working and I'm getting data in, but every time the input runs it pulls the entire database again instead of just pulling in the newest data. How do I limit what it pulls?

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use a Rising input.  This is where DBX keeps track of the last value seen for a specific field so subsequent queries can fetch newer values.

See https://docs.splunk.com/Documentation/DBX/3.18.1/DeployDBX/Createandmanagedatabaseinputs#Choose_inpu... for details.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...