I want to import only the last X months/days/whatever of data from my database via DB Connect. Is there a better procedure than the following?
Is it possible to create the $SPLUNK_HOME/var/lib/splunk/persistentstorage/dbx/HASH/state.xml and manifest.properties manually? What hash function does Splunk use and what does it hash? The input name or something else?
It looks like the suggestions do not work "as-is" for this particular Oracle table but they are far better than what I came up with myself and got me started in a much better direction. With the help of a DBA, we settled on using:
SELECT ... WHERE LOG_TIMESTAMP > TO_DATE('2013/07/30 01:00:00 PM', 'YYYY/MM/DD HH:MI:SS PM') {{AND $rising_column$ > ?}}
I add the following outside the brackets: where datefield > "12/1/2010 00:00:00" {AND $rising_column$ > ?}
Then you can set the retention on the index.