Monitoring Splunk

Compare data row count in Splunk Vs SQL server

MittalKamal
Explorer

Hi,

I am fetching data for Splunk from Sql database. I found some of the rows are missing..

I am checking it for complete day with below splunk query

index="myavista_events" sourcetype="myavista:sitecore:sqldb" | stats count

and for the same period I am checking it SQL with sql query and found lots of diff in count.. In SQL data count is more as compare to Splunk.. SO some data is missing in Splunk.

 

I am fetching the data at every 5 min interval from DB.. And I tried to check the count in each fetch with below Splunk query..

index=_internal ServerName "format_hec_success_count" 

This is giving count like format_hec_success_count=3365 

But this number is also not matching with sql query for same timespan..

Please suggest how can I get the complete sql data in splunk...

Labels (1)
1 Solution

MittalKamal
Explorer

@thambisetty 

I found the solution for it.. There should be integer incremented value for rising column that Spunk understand properly..

I also changed the rising column to it Id (int incremented value in DB) instead of datetime and its working fine..

View solution in original post

0 Karma

MittalKamal
Explorer

@thambisetty 

Sorry for late reply..

Rising column is eventDateTime

No, events are not overridden in DB

0 Karma

thambisetty
SplunkTrust
SplunkTrust

@MittalKamal 

what is your rising column?

are events overwritten in 5 minutes in DB?

 

————————————
If this helps, give a like below.
0 Karma

MittalKamal
Explorer

@thambisetty 

I found the solution for it.. There should be integer incremented value for rising column that Spunk understand properly..

I also changed the rising column to it Id (int incremented value in DB) instead of datetime and its working fine..

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...