The issue is mainly due to rising column value being null. The rising column field should be unique for splunk to identify any new data.
You can check for the with your database administrator to add a key value to the current tables or use a timestamp filed if already available. if not you can also use cast to create a new field, example below and use this field as your rising column. Ensure you put some checkpoint value.
cast(
cast(datepart(year, eventtime) as varchar) +
right('0' + cast (datepart(month, eventtime) as varchar),2) +
right('0' + cast (datepart(day,eventtime) as varchar),2) +
right('0' + cast (datepart(hour,eventtime) as varchar),2) +
right('0' + cast (datepart(minute,eventtime) as varchar),2) +
right('0' + cast (datepart(second,eventtime) as varchar),2) +
right('0' + cast (datepart(millisecond,eventtime) as varchar),3)
as numeric(18,0)) as numtime
... View more