All Apps and Add-ons

Splunk DB Connect: Is it possible to clear all rows in database and add all results (old and new) for every execution?

ankithreddy777
Contributor

Hi,
I have to send results to the database from Splunk using Splunk DB Connect. But in documentation it is given that for every execution only the updated results will added to database table.
Is it possible to clear all rows in database and add all results (old and new) for every execution?

0 Karma

woodcock
Esteemed Legend

You are probably aware that you have posted this question twice, right?

https://answers.splunk.com/answers/494339/delete-database-results-and-update-with-new-result.html#an...

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi ankithreddy777,
using DB Connect you can acquire records in two ways:

  • all query results;
  • only newest records. you can choose the preferred Input Type in the creation of database input (see http://docs.splunk.com/Documentation/DBX/2.4.0/DeployDBX/Createandmanagedatabaseinputs#Choose_and_pr...) If you choose "batch input" you take all the times all the query's results, if you choose "Rising column" you have to choose a field, always growing, to use to record the check point (Splunk records in a configuration file the last value of the rising column from the executed query and uses it as starting point for the next one). There is also a third choose ("Advanced") similar to "Rising column". Bye. Giuseppe
0 Karma

ankithreddy777
Contributor

Hi Cusello,
How to send all results to the database for every execution. Instead of only new results using database. Can we delete results in database?

0 Karma

gcusello
SplunkTrust
SplunkTrust

No the "Batch input" option permits to download all the results of a query, but it doesn't delete records from DB, it's possible but you have to grant deletion privileges to the user that you use to connect to your DB (it isn't a usual procedure!) and create another DB script to delete the downloaded records.

Why you don't want to use the "Rising column" method? it's really more efficient!
If the problem is that you have rotation of your DB (in this way your rising column will be reset at every file rotation), you can manage this situation in an easy way:

  • add to your query an additional field resulting by timestamp + growing code
  • use this new field as rising column. In this way your rising column will be always growing.

Bye.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...