db connect trailing input

[aaronkorn]

Hello,

We have a database that we would like to do a trailing input on based on the incrementing ID. Once it is indexed into Splunk via the query, if that record on the database is updated will Splunk pickup that change and update the indexed record? If not should we use the dump option? My only concern with the dump option is duplicate records and how to overcome that.

[lukejadamec]

No, it will not pick up the change because the Trailing Input functions by monitoring the RisingColumn.

You are right about the Dump option - it will create duplicate records.

The easiest way to protect from duplicate data is isolate the database data in its own index:

1) Create an index dedicated to that database data.

2) When new data is entered into the database, clean the index with $SPLUNK_HOME/bin/splunk clean eventdata -index

Note: You must stop splunkd first, and be careful with this command because you can accidentally delete all indexes.

3) Re-ingest the entire database.

Your best option would be to create a (or use) the column that timestamps any changes to a record (a true RisingColumn)