All Apps and Add-ons

Splunk DB Connect: How does the approval_flag impact the output of the rising column?

jamesmoriarty
Explorer

Hello!

I've been working with Splunk's DB Connect App for a few weeks and I have a question regarding the rising column. I'm attempting to only pull records that have been approved (weekly) so I have my SQL's WHERE clause structured similar to this:

WHERE approval_flag=1 AND rising_column > ?
ORDER BY rising_column

My question is this - will the rising column be updated to the most recent event regardless of an approval flag (or other condition)?

The reason I ask this question is because I noticed certain information missing during the weeks I tested a rising column solution. The information pertains to employee hours, and hours are approved by supervisors. Since there are multiple supervisors, hours are approved at different times. I'm wondering if the rising column will update to the most recent event, even if it isn't approved, perhaps leaving out events that were once unapproved but later approved.

This is all based on a hunch because I haven't found a lot of documentation on this particular subject of rising column. Thanks for any information/tips that may come!

-James M

0 Karma

jplumsdaine22
Influencer

Correct. Your rising column value will be updated if any results are found. So say you have 10 records, and the rising column value is 1-10, and all the approval_flag values are set to zero. The first time the input runs, it will return no results. If someone then sets the approval flag to 1 for records 1, 6 and 8, the input will retrieve Those three records your rising column value will now be 8. Then the next time the input runs the query will be

WHERE approval_flag=1 AND rising_column > 8 ORDER BY rising_column

Values of rising_column less than 8 will never be retrieved, even if their approval flag changes to 1.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...