which is your time field? and your rising column should be incrementing. Do a where clause where it should ignore all the previous data then fetch it. ... View more

Did you set the props.conf in your app updated in your post? that is really required. Even after that it doesn't work i have to officially tell sorry and wait for some Splunk person to assist you. ... View more

check in dbx.log for any kind of error. It works great for many so shouldn't be disheartened with small failures ... View more

You are looking at one of my favorites. Max Data on Dashbaord Thanks ... View more

i have done some modification. if possible follow my step to clear the counter to monitor from starting if they come correctly. output.timestamp.format is not that important so ignore it for now ... View more

try with you monitor stanza. If the data is already indexed it will not help you anymore. You have to delete the index and re-index the files after clearing the fish bucket at forwarder end. ... View more

mention host name for the input in the splunkforwarder. ... View more

Try this sourcetype=xxx| rex field=_raw/field_name "~dpno~(?<Val>\\d+)" |table Val field_name= address/ something which has been extracted by splunk ... View more

got the real problem where splunk doesn't check the old date so need to set a props.conf. Try my updated answer ... View more

do you get any error in dbx.log? does it show you any error like ERROR PARSING TIMESTAMP? OR anything? ... View more

forgot to mention one simple thingy select top 1 convert(datetime,posting_date) as PostedDate {{ ... $rising_column$ > ?}} for dbtail. I have just done with some tests with you kind of sample data splunk recognized everything perfectly. Using DB connect 1.1.3 ... View more

if you are getting the data and the time.format.parse doesn't work try setting the source in a props.conf file for time recognition. ... View more

but you are returning Truck rather than CAR! do you see same result before where in both searches? then how is it the same? if true print a| where a=0 is not same as if true print b |where a=0 ... View more

no it is not necessary as you rightly said , output.timestamp = 1 then you need the format else all the config is fine and the output.timestamp doesn't affect the input. Just try dump your data into some default index to see if it works. More than that just check in dbx.log what exactly is happening... Please come back if you see any issue 🙂 ... View more

yes you can, |eval dbconnector=xxx|field + dbconnector |stats count by dbconnector ... View more

Because it's not only Showroom , where like(model,"%U%") is also involved. ... View more

Hello Devicenul, There is no need of having the convert function. Is the field in datetime format in DB? If yes DB Connect will automatically recognize that and assign it to your events. Sample configuration which works for me. Updated Config: inputs.conf [dbmon-tail://test/taily] index = main interval = 30 output.format = csv output.timestamp = 0 output.timestamp.column = posting_date output.timestamp.format = %d/%m/%Y %H:%M:%S query = select top 1 posting_date,posting_date as PostedDate {{WHERE $rising_column$ > ?}} sourcetype = dummy table = dummy tail.rising.column = posting_date Props.conf [dummy] MAX_DAYS_AGO = 5000 TIME_FORMAT=%s Splunk will consume the posting_date field to get the eventtime. Note: if any rising column value has already been recorded then go to Splunk\var\lib\splunk\persistentstorage\dbx\ d6db0e2901cbef084bc0f4c01134d4f6 kind of dir Thanks ... View more

Can i change this config specific to one app? ... View more

try |timechart count(status) as status,count(owner) as owner Thanks ... View more

if you have any other older version of splunk just copy replace the sendemail.py file. ... View more

|metadata type=sourcetypes index=fmo*|where recentTime < now()-2592000|convert ctime(*Time) before convert just use a where condition to check your requirement ... View more

Hi Mike, The timeformat looks to be simple which splunk should have read it automatically which will mean Starttime=_time(default eventtime) if not you need a convertion before make it to your usable format. So it would go like this |eval StartTime=strptime(StartTime, "%Y-%m-%dT%H:%M:%S")|eval StartTime=strftime(StartTime,"%d-%b-%Y") OR |eval StartTime=strptime(StartTime, "%Y-%m-%dT%H:%M:%S")|convert timeformat="%d-%b-%Y" ctime(StartTime) Thanks ... View more

are we expecting a 6.1 re-release with the fix embedded? we want to move to the awesome 6.1 as soon as possible 🙂 ... View more

not really embarrassing it wont forward any existing indexed data. You could copy them over to the new server and append the new events from now on.. ... View more