why my events are showing higher than the databases values?

[saibhaskar]

Hi there,

I'm trying to fetch the records from one of the table in my SQL SERVER database.The No.of records in that table is 420.When i'm trying to fetch those record using "Splunk DB Connect",it shows around 10,000+ events.

Can any one help me out why this is happenning?

Thanks,
sai bhaskar.

[saibhaskar]

Hi ,

I am pretty sure that i am fetching records from a specific table having 420 records exactly not more than that.As i'm using Splunk DB Connect, there i have an option to select Database,DB schema,and Database Table as well.
So,i'm sure that fetching records from the table that i want to search. In Splunk DB Connect App i have an another option to search records by clicking "fetch Records " button.
Even though i'm using the same i got the events more than 10000+.

Here is my search string ==> index=main source=mi_input://transactions sourcetype=transactions
my query is ==> select * from [dbo].[TEST_DB].[transactions]
transactions is my tablename

By executing the query i can able to fetch the exact 420 records, but the same can't happening in search.
Can anyone figure it out.

Thanks,
sai bhaskar

[hunters_splunk]

Hi saibhasker,

What query did you run to fetch records from your SQL Server table? Are you sure you were query for records fro that specific table, not other events or usage data?

Thanks!

[somesoni2]

And how are you fetching the records, using an adhoc database query OR you've setup database monitoring?