All Apps and Add-ons

Advice on tailing database based on commit timestamp

gwiley_splunk
Splunk Employee
Splunk Employee

I have a database table that I want to index using dbmon-tail based on the commit time column. If I have multiple rows that have the same commit timestamp can I get into a situation where some rows won't be indexed if, for example, there is a network disconnect between Splunk and the database?

For example, there are 10 rows all with the same batch commit timestamp but Splunk only got 3 of them before a disconnect occurred. When the connection is restored would Splunk only continue from the next newer timestamp, assuming that there is no other column that could be used as a rising column?

Is there any difference in behaviour in this case between v1 and v2 of DB Connect?

Cheers

0 Karma
1 Solution

jcoates_splunk
Splunk Employee
Splunk Employee

No, this is a standard risk of using time as the rising column. Some form of database change will be needed. Either add a unique Row ID column, or increase the resolution of the existing time column.

View solution in original post

jcoates_splunk
Splunk Employee
Splunk Employee

No, this is a standard risk of using time as the rising column. Some form of database change will be needed. Either add a unique Row ID column, or increase the resolution of the existing time column.

gwiley_splunk
Splunk Employee
Splunk Employee

Thanks, you've confirmed what I thought.

And there's no difference in behaviour between v1 and v2 in this regard?

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

That's correct.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...