Our way is to pull data from sql view to splunk through dbconnect.
The splunk inded is not pulling the data available in view properly into splunk index.ex-when there is more than 30k rows in views , a particular field is showing very minimum rows like 4k only, but the total count of index matches with the view as 30 k.
My question here is why a particular field gets minimum entries .I have recreated the index after deleting the old one ,but still facing the same issue .
Please help me with solution.
... View more