Hi all,
How to change the Checkpoint Value in a Splunk DB Connect 2 input for rising column?
Current Checkpoint value=2023-10-04 09:53:43.0, it's not indexing any events.
Go to $SPLUNK_HOME/etc/apps/splunk_app_db_connect/defaults/inputs.conf, and look for tail_rising_column_checkpoint_value. You can either remove that line altogether or change the timestamp to some other value. Note that this may re-index records you may have already indexed, unless you delete them from Splunk first. If you don't see the checkpoint value under the default folder, then look under local. You may need to restart Splunk after updating inputs.conf.
Go to $SPLUNK_HOME/etc/apps/splunk_app_db_connect/defaults/inputs.conf, and look for tail_rising_column_checkpoint_value. You can either remove that line altogether or change the timestamp to some other value. Note that this may re-index records you may have already indexed, unless you delete them from Splunk first. If you don't see the checkpoint value under the default folder, then look under local. You may need to restart Splunk after updating inputs.conf.
Its changing again once it ran.. How to solve this issue
It always updates with the timestamp of the last record it indexed, so it knows where to pick up when new records are added to the database. Also, I just noticed that the timestamp in your example has 2023 for the year. If new records are added to your database with a year less than that (i.e. 2016) they won't get indexed.
Is this the issue with query?