Splunk Search

why my events are showing higher than the databases values?

saibhaskar
Engager

Hi there,

I'm trying to fetch the records from one of the table in my SQL SERVER database.The No.of records in that table is 420.When i'm trying to fetch those record using "Splunk DB Connect",it shows around 10,000+ events.

Can any one help me out why this is happenning?

Thanks,
sai bhaskar.

Tags (1)
0 Karma

saibhaskar
Engager

Hi ,

I am pretty sure that i am fetching records from a specific table having 420 records exactly not more than that.As i'm using Splunk DB Connect, there i have an option to select Database,DB schema,and Database Table as well.
So,i'm sure that fetching records from the table that i want to search. In Splunk DB Connect App i have an another option to search records by clicking "fetch Records " button.
Even though i'm using the same i got the events more than 10000+.

Here is my search string ==> index=main source=mi_input://transactions sourcetype=transactions
my query is ==> select * from [dbo].[TEST_DB].[transactions]
transactions is my tablename

By executing the query i can able to fetch the exact 420 records, but the same can't happening in search.
Can anyone figure it out.

Thanks,
sai bhaskar

0 Karma

hunters_splunk
Splunk Employee
Splunk Employee

Hi saibhasker,

What query did you run to fetch records from your SQL Server table? Are you sure you were query for records fro that specific table, not other events or usage data?

Thanks!

0 Karma

somesoni2
SplunkTrust
SplunkTrust

And how are you fetching the records, using an adhoc database query OR you've setup database monitoring?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...