Hi @mayurr98, Is it ingesting exactly 10,000 events per hour or is that figure rounded? The query is set to run four times per hour. Does it return 2,500 events per run, or does the first run ret...
See more...
Hi @mayurr98, Is it ingesting exactly 10,000 events per hour or is that figure rounded? The query is set to run four times per hour. Does it return 2,500 events per run, or does the first run return 10,000 and the rest 0? Are there any error messages in the internal logs? index=_internal sourcetype=dbx_* Also, how much more than 10,000 events are we talking here? There could be a few different causes depending on the answers to the above questions. First check there are no other random db_inputs.conf files overwriting your above settings. Perhaps use btool to check this. Next, as DB Connect v3 and above uses HEC under the hood, use btool to check limits.conf to see if the max_content_length setting is too restrictive. Depending on what you find in the logs, you might also consider reducing the max_rows and/or fetch_size settings and/or decreasing the interval. Counterintuitive as it sounds, this might actually improve number of events returned, if there is some performance bottleneck preventing the query from completing. Regards, K