I do not think that Splunk will update the LAST_ARCHIVE_TIMESTAMP - not by itself. However, in the doc Splunk says that it does support calling a procedure of an Oracle Database https://docs.splunk.com/Documentation/DBX/3.7.0/DeployDBX/Commands But I do not know if its only the case of procedures returning events as cursor to be pulled by DB Connect, or even the (your) case of a procedure just doing some actions and returning no rows. If the second is true, I guess that calling DBMS_AUDIT_MGMT.SET_LAST_ARCHIVE_TIMESTAMP( audit_trail_type IN PLS_INTEGER, last_archive_time IN TIMESTAMP, rac_instance_number IN PLS_INTEGER DEFAULT NULL, container IN PLS_INTEGER DEFAULT CONTAINER_CURRENT, database_id IN NUMBER DEFAULT NULL, container_guid IN VARCHAR2 DEFAULT NULL); https://docs.oracle.com/en/database/oracle/oracle-database/19/arpls/DBMS_AUDIT_MGMT.html#GUID-75EE6B31-98A1-4353-9000-A293E4752380 ... will set the right timestamp
... View more