This works {{AND $rising_column$ > ?}} with MSSQL The ? references the rising_column field you set outside the query in "Tail Input settings". After the first parse where the entire output of the query is pulled into Splunk. The tail option kicks in and only pulls in new data based on the rising column. ... View more