Splunk fetching results from database in realtime

[ankithreddy777]

Can we set frequency to fetch results from database to real time. Does that effect anything.

Does Splunk take more space to index database inputs rather than regular raw data inputs. I assume so, because the field-values from database inputs seems to be indexed too.

[richgalloway]

There is no real-time fetching of database rows. Splunk reads from a database by executing a SQL query at regular intervals. It has no way of knowing when new data has been added to the database before executing the query.

The space needed to index data depends on how that data is presented to Splunk. Database data may take more space, but it depends on what you use for a comparison.

[ankithreddy777]

Thank you for you response
If I give cron schedule as ***** (five stars) . At what intrval does this execute the query?

[richgalloway]

Once a minute.