Splunk Search

DBConnect fetch not to consider latest value of rising column

pradeepkumarg
Influencer

The rising column I'm using is a time stamp and at times there are many records with the same value and if the fetch happens in the middle of those records, DBConnect is missing the rest of the records coming with the same value.

How can I limit the fetch not to consider the latest value so that all of them are fetched in the next run.

Example rising column value - dateUpdated - 2014-08-05 13:39:00.0

0 Karma
1 Solution

pradeepkumarg
Influencer

pradeepkumarg
Influencer

I found the answer mentioned in the below thread solves the purpose

http://answers.splunk.com/answers/68699/database-table-doesnt-have-rising-column-totally

Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...