Splunk Search

Splunk DB Connect - Tail only from latest value in database?

falkyre
Explorer

Still trying to get the tail monitor working. It seems that once it's enabled and scheduled, then executed, the first run takes ~ 4 hours to get the information from the database. Is there any way to force the tail to start at the last record in the database? Or at least have the ability to provide a starting point based on the rising value column being used?

Tags (1)
1 Solution
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...