All Apps and Add-ons

Splunk DB Connect: Is it possible to clear all rows in database and add all results (old and new) for every execution?

ankithreddy777
Contributor

Hi,
I have to send results to the database from Splunk using Splunk DB Connect. But in documentation it is given that for every execution only the updated results will added to database table.
Is it possible to clear all rows in database and add all results (old and new) for every execution?

0 Karma

woodcock
Esteemed Legend

You are probably aware that you have posted this question twice, right?

https://answers.splunk.com/answers/494339/delete-database-results-and-update-with-new-result.html#an...

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi ankithreddy777,
using DB Connect you can acquire records in two ways:

  • all query results;
  • only newest records. you can choose the preferred Input Type in the creation of database input (see http://docs.splunk.com/Documentation/DBX/2.4.0/DeployDBX/Createandmanagedatabaseinputs#Choose_and_pr...) If you choose "batch input" you take all the times all the query's results, if you choose "Rising column" you have to choose a field, always growing, to use to record the check point (Splunk records in a configuration file the last value of the rising column from the executed query and uses it as starting point for the next one). There is also a third choose ("Advanced") similar to "Rising column". Bye. Giuseppe
0 Karma

ankithreddy777
Contributor

Hi Cusello,
How to send all results to the database for every execution. Instead of only new results using database. Can we delete results in database?

0 Karma

gcusello
SplunkTrust
SplunkTrust

No the "Batch input" option permits to download all the results of a query, but it doesn't delete records from DB, it's possible but you have to grant deletion privileges to the user that you use to connect to your DB (it isn't a usual procedure!) and create another DB script to delete the downloaded records.

Why you don't want to use the "Rising column" method? it's really more efficient!
If the problem is that you have rotation of your DB (in this way your rising column will be reset at every file rotation), you can manage this situation in an easy way:

  • add to your query an additional field resulting by timestamp + growing code
  • use this new field as rising column. In this way your rising column will be always growing.

Bye.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...