Splunk Search

Why full dump of a table from Oracle DB fails when the table structure changes?

suhasyodlee
New Member

Hi Team,
I was trying out this exercise, which would come handy when we hook on splunk to our production DB's.

-> Created a full dump db-input on a table, All the rows from that table were indexed in splunk.
-> Dropped a column from the table on which db-input was created, and then added two rows to that table, did not see those two rows coming in, nor did the logs in dbx.log give any errors/information
-> recreated the column back, and added two more rows, made the table similar to how it was when the db input was created, but did not see those 2 rows from the 2nd scenario or 2 rows in this scenario getting indexed in splunk. Did not see any information related to this in the logs as well.

Can you please help me here to find out if there is a way of carrying out this exercise successfully.

Thanks in advance.

0 Karma

suhasyodlee
New Member

Hi @theouhuious & @pmdba,
Thanks for the replies, greatly appreciated.

I did not make any changes in the DBInput because it was a full dump, the original DB-Input should remain valid (select * from table).
After dropping a column, i issued a query against that table in DBQuery, i got the results, but DBInput doesn't work 😞

I did not see any logs relating this db input after dropping one column and adding two rows.
And there were no logs printed either when i added back that column and added two more rows.

Table Structure :
Emp
( emp id number, emp_name varchar2(10). job_id number salary number(8.3), joining_date date, is_permanent number(1)).

Query used in the full Dump
-> select * from emp.

after the first successful dump, i dropped is_permanent column and added two rows, and then created back is_permanent column and added two rows.

0 Karma

pmdba
Builder

If there was an error dumping the table, it should be in the dbx.log file. Knowing the specific error (if any), the table structure, and the SQL used in the dump would help a lot in answering your question.

0 Karma

theouhuios
Motivator

Did you make changes tin the Input and try it in the DB query to see if the new tables are reflected in the output? try to see in DB info if you can see the new tables for that DB Connection. If they show up in that, then try the query in DBQuery and check the output.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...