Hi Splunkers,   I am writing on SPL in the report which has lookup. And if the lookup has less number of rows then overwrite the lookup with existing static lookup.   Example: <myseach> | outputlookup test1.csv | stats count | < if/where condition , where i need to check if the count < 100 , then overwrite existing static lookup into test1.csv else remain as-is"                          count < 100 , "| inputlookup testlookup.csv | outputlookup test1.csv" , "test1.csv"  ... View more

Hi Splunkers, I have enabled the batch mode for a date field with below query in DB Connect : SELECT * FROM SCHEMANAME.TABLENAME WHERE Termination_date >= from_unixtime(unix_timestamp()-1*60*60*24, 'yyyy-MM-dd') ORDER BY Termination_date DESC;   The Table doesnt have any primary key and hence making using of batch mode in db connect to retrieve all the data from the table when comparing with one of the date fileds in the table "Termination_date".   The table generates 5000 rows in a day. Hence I have given a condition to schedule the script every 300 seconds and retrieve 300 rows .   My Question:: Will it retrieve last 300 rows of the day or it will keep on ingesting first 300 rows from the table into splunk (I have given DESC in the sql query). Is there any other solution to get the data by using the same date field as there is no primary key.   Thanks in advance. ... View more

I need to ingest the data from DB to Splunk via DBCONNECT. Need to choose a column for a RISING column which has a data and time field in it with below format : starttime=2020-06-16 01:26:35.595026665 How shall I convert the above time format at the query level so that it is used for checkpoint as a primary key to use it as a RISING Column . ... View more

Any Demo video on Splunk ITSI ( Service Analyzer , DeepDives and Glass Tables) creation/setup ? ... View more