Thanks Gaurav for the reply. Could you kindly elaborate ... View more

I have used query as below in DBconnect SELECT COALESCE(field1,'NULL') AS field1, field2 FROM "schema1"."table1" and getting the desired results ... View more

Thank You Rich The major problem is , most of the time, making changes to the DB side is near impossible ! Thanks Raja ... View more

Hi Dev Does not look like a DB connect issue here. Looks more like a permission issue on the audit file. For further diagnosis - Try to read from a regular table (instead of Audit file) in DB Connect as Batch and as rising and see if its working. ... View more

Hi Dev, Note : You need to execute the query once to let the values for the Rising Column selector to be populated . Rgds Raja ... View more

Hi Dev 1. Try deleting the check point file in "C:\Program Files\Splunk\var\lib\splunk\modinputs\server\splunk_app_db_connect". The check point file will automatically be created at the next cycle. 2.Try your query directly in DBConnect - SQL editor and see if the results are as expected Rgds Raja ... View more

Hi Deven, Try disable inheritance for this folder from windows advanced security settings Rgds ... View more

In windows environment, 1. Splunk DB connect log files are stored in C:\Program Files\Splunk\var\log\splunk folder the files are splunk_app_db_connect_*.log 3. Splunk DB connect rising values are stored in C:\Program Files\Splunk\var\lib\splunk\modinputs\server\splunk_app_db_connect A file with the connection name stores the values of the rising column If rising columns are are not working, it is possible that " C:\Program Files\Splunk\var\lib\splunk\modinputs\server\splunk_app_db_connect" folder is ready only. So DB Connect is not able to update the check point files with recent values. Change the permissions on the folder/file to and Read+Write and rising columns should start working. It is not a must to specify each field in the Select statement. We can simply use * , for example "Select * from "SYSTEM"."CUSTOMERS" where CustomerID > ? ORDER by CustomerID ASC Regards Raja Rajesh ... View more

Issue was related to Database not DBconnect ... View more