I have a database table that I want to index using dbmon-tail based on the commit time column. If I have multiple rows that have the same commit timestamp can I get into a situation where some rows won't be indexed if, for example, there is a network disconnect between Splunk and the database?
For example, there are 10 rows all with the same batch commit timestamp but Splunk only got 3 of them before a disconnect occurred. When the connection is restored would Splunk only continue from the next newer timestamp, assuming that there is no other column that could be used as a rising column?
Is there any difference in behaviour in this case between v1 and v2 of DB Connect?
... View more