Configuring a dbmon-dump input is the right way to go. Configuration screens in the Splunk UI are sometimes incomplete or missing lesser used options, however. If you haven't done this already, you may have to edit the inputs.conf file for your app directly in order to get things working or formatted the way you want them to be. ... View more

Hello lguinn, Thanks you for your reply. The output I gave in the OP is my result set from the SQL query. The transaction should take into account both the ID and the Status. But I tried this in the DB connect app and it still does not work. Is it that the transaction function can only be used in the Search app? ... View more