DBX > 1.2 rising_column in query problem

[StewGoin1]

So, to get around the known issue with rising_column not being able to be fully qualified (which is sort of required for how we poll ePO data via SQL) we implemented a different workaround than a wrapper query since that seems like it would be very hard to do without selecting every event (since we're trying to use EPOEvents.AutoID as the rising column).

So that column was mapped to event_id in the beginning of the query, then we set the rising_column to event_id and in the query never referenced $rising_column$ as a variable, just the checkpoint ?, i.e.:

{{WHERE EPOEvents.AutoID > ? }}

This worked just fine through 1.1.1, but when we patched to 1.1.2 the dbx.log would show that the query was invalid and contain this error that clued us into something being different in how 1.1.2 was parsing / requiring $rising_column$ within the query itself:

without proper {{ ... $rising_column$ > ?}} pattern!

Is there anyway to force 1.1.2 or 1.1.3 now to NOT try and validate that the query is using $rising_column$ within the query? It prevents us from upgrading right now.

[jcoates_splunk]

There were some issues with DB Connect 1.1.3 and prior, use this with 1.1.4: http://apps.splunk.com/app/1819/

[dshpritz]

I ran in to this as well. I think my solution was to set the rising column to "AutoID" and then chance the where clause to:

{{WHERE EPOEvents.$rising_column$ > ?}}

You may need to adjust your rising column in the the tracking file. More on that here.

HTH,

Dave

[dshpritz]

There are some possible workarounds in the release notes: http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Releasenotes

[StewGoin1]

So, in attempting this I get the "AutoID column doesn't appear in results" errors. DBX not handling fully qualified column names seems to be making this just not work.