Monitoring Splunk

Compare data row count in Splunk Vs SQL server

MittalKamal
Explorer

Hi,

I am fetching data for Splunk from Sql database. I found some of the rows are missing..

I am checking it for complete day with below splunk query

index="myavista_events" sourcetype="myavista:sitecore:sqldb" | stats count

and for the same period I am checking it SQL with sql query and found lots of diff in count.. In SQL data count is more as compare to Splunk.. SO some data is missing in Splunk.

 

I am fetching the data at every 5 min interval from DB.. And I tried to check the count in each fetch with below Splunk query..

index=_internal ServerName "format_hec_success_count" 

This is giving count like format_hec_success_count=3365 

But this number is also not matching with sql query for same timespan..

Please suggest how can I get the complete sql data in splunk...

Labels (1)
1 Solution

MittalKamal
Explorer

@thambisetty 

I found the solution for it.. There should be integer incremented value for rising column that Spunk understand properly..

I also changed the rising column to it Id (int incremented value in DB) instead of datetime and its working fine..

View solution in original post

0 Karma

MittalKamal
Explorer

@thambisetty 

Sorry for late reply..

Rising column is eventDateTime

No, events are not overridden in DB

0 Karma

thambisetty
Super Champion

@MittalKamal 

what is your rising column?

are events overwritten in 5 minutes in DB?

 

————————————
If this helps, give a like below.
0 Karma

MittalKamal
Explorer

@thambisetty 

I found the solution for it.. There should be integer incremented value for rising column that Spunk understand properly..

I also changed the rising column to it Id (int incremented value in DB) instead of datetime and its working fine..

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!