splunk dbconnect tail issue

[rameshlpatel]

hi,
at time of adding database input i select tail as input type and add following query.

SELECT
pkey,fk_vehicle,created,processed,status,lasterror,obuid,started
FROM ocs_admin.tp_obuimportdata
{{WHERE $rising_column$ > ?}}

and add raising column field as 'created' column name.

My requirement is i want to fetch data from current timestamp but above configuration is fetching all table data.

Please suggest help.

[abhijitmishra]

To the inputs.conf stanza add the following

tail.follow.only = true

[linu1988]

which is your time field? and your rising column should be incrementing. Do a where clause where it should ignore all the previous data then fetch it.