Getting Data In

splunk dbconnect tail issue


at time of adding database input i select tail as input type and add following query.

FROM ocs_admin.tp_obuimportdata
{{WHERE $rising_column$ > ?}}

and add raising column field as 'created' column name.

My requirement is i want to fetch data from current timestamp but above configuration is fetching all table data.

Please suggest help.

0 Karma


To the inputs.conf stanza add the following

tail.follow.only = true


which is your time field? and your rising column should be incrementing. Do a where clause where it should ignore all the previous data then fetch it.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...