Yes, both Splunk inputs will grab the same [full] set of data, though perhaps at different times. Inputs like these should be independent. See below for more explanation. Assume you have a DB input on Splunk Server 1 that gets its input from, say, DBServerA, TableX. Then another DB input on Splunk Server 2 that gets its input from DBServerA, TableX as well. Each Splunk server runs a SQL Query like select * from TableX {{ where $rising_column$ > ?}} The first time through, the {{ ... }} is left off so the input can grab all the data. After that, each Splunk server will remember the last value for whatever has been declared as the $rising_column$ and use that for subsequent queries. Therefore, each server will get a copy of all rows that are newer than the last row that server had last requested, regardless of what other queries may have happened in the interim (applications, other Splunk servers, etc...) ... View more

The order of the options in the rex command is wrong, and the regular expression has to be in a sed script. This is more correct: ...| rex field=transport_route_id mode=sed "s/[^a-zA-Z0-9]//g" See more in the docs. http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex EDIT: forgot to link to docs... /K ... View more