All Apps and Add-ons

Database Inputs - Importing Data from SQL to Splunk problem

Vijaikanth
Path Finder

I have three columns in my SQL table "tblAudit"

Id SQL query ExecutedTime
1 select * from xxx where x= y Jan 1, 2016
2 Insert table xxx (select ....) Jan 30, 2016
3 Delete table.. Create trigger Jan 31, 2016

Now i need to input these details to splunk. Now Database Inputs >> Dump >> Specify SQL query >> Select * from tblAudit >> Save

Instead of 3 events there are 10 events displaying in Splunk and the problem is due to the column "SQL Query". It split the events somehow not sure if it is due to sql keywords and make it as 10 events. If the column "SQL Query" was not included in dump, it return exact 3 events. What is the problem here?

Tat column "SQL Query" is nVarchar(4000) in sql server.

0 Karma
1 Solution

Vijaikanth
Path Finder

In my case, Splunk Split one event into multiple events because of the following parameter in props.conf

LINE_BREAKER = (\r\n)

So i removed the "\r\n" combination in the sql column by executing the below query in SQL table

/** Remove Carriage return and Line Feed **/
UPDATE ProblemTable
SET ProblemColumn = REPLACE(ProblemColumn, char(13), ' ' )

UPDATE ProblemTable
SET ProblemColumn = REPLACE(ProblemColumn, char(10), ' ' )

After corrected the SQL server column values, Splunk not created any multi level events and data loaded correctly.

View solution in original post

0 Karma

Vijaikanth
Path Finder

In my case, Splunk Split one event into multiple events because of the following parameter in props.conf

LINE_BREAKER = (\r\n)

So i removed the "\r\n" combination in the sql column by executing the below query in SQL table

/** Remove Carriage return and Line Feed **/
UPDATE ProblemTable
SET ProblemColumn = REPLACE(ProblemColumn, char(13), ' ' )

UPDATE ProblemTable
SET ProblemColumn = REPLACE(ProblemColumn, char(10), ' ' )

After corrected the SQL server column values, Splunk not created any multi level events and data loaded correctly.

0 Karma

Vijaikanth
Path Finder

Sample SQL Query Failing :
select * from xx s inner join xy d on s.id = d.id where s.code = 'Y' and s.desc = 'N' and s.total = 2 order by d.date desc

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...