Hello, From the GUI (DB Input), it seems that Splunk is unable to detect any Rising Column due to our sub query:     SELECT event_time FROM sys.fn_get_audit_file ( (SELECT TOP(1) e.audit_file_path FROM [sys.dm_server_audit_status] e WHERE e.name = 'Audit-select-statement'), default, default) WHERE event_time > ? ORDER BY event_time ASC       unfortunately, Splunk DB Connect is unable to detect any rising column. If I remove the SELECT TOP(1), the rising column appear again. The goal is to query the audit table with the current filename. I saw another discussion (https://community.splunk.com/t5/Splunk-Search/DB-Connect-rising-column-combination-of-two-columns/m-p/121434) but seems the enhancement request (DBX-564) is still not ready. Would anyone happen to have the same issue ? Kind Regards,   ... View more