Monitoring Splunk

Compare data row count in Splunk Vs SQL server

MittalKamal
Explorer

Hi,

I am fetching data for Splunk from Sql database. I found some of the rows are missing..

I am checking it for complete day with below splunk query

index="myavista_events" sourcetype="myavista:sitecore:sqldb" | stats count

and for the same period I am checking it SQL with sql query and found lots of diff in count.. In SQL data count is more as compare to Splunk.. SO some data is missing in Splunk.

 

I am fetching the data at every 5 min interval from DB.. And I tried to check the count in each fetch with below Splunk query..

index=_internal ServerName "format_hec_success_count" 

This is giving count like format_hec_success_count=3365 

But this number is also not matching with sql query for same timespan..

Please suggest how can I get the complete sql data in splunk...

Labels (1)
1 Solution

MittalKamal
Explorer

@thambisetty 

I found the solution for it.. There should be integer incremented value for rising column that Spunk understand properly..

I also changed the rising column to it Id (int incremented value in DB) instead of datetime and its working fine..

View solution in original post

0 Karma

MittalKamal
Explorer

@thambisetty 

Sorry for late reply..

Rising column is eventDateTime

No, events are not overridden in DB

0 Karma

thambisetty
SplunkTrust
SplunkTrust

@MittalKamal 

what is your rising column?

are events overwritten in 5 minutes in DB?

 

————————————
If this helps, give a like below.
0 Karma

MittalKamal
Explorer

@thambisetty 

I found the solution for it.. There should be integer incremented value for rising column that Spunk understand properly..

I also changed the rising column to it Id (int incremented value in DB) instead of datetime and its working fine..

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...