Hi ,
Our way is to pull data from sql view to splunk through dbconnect.
The splunk inded is not pulling the data available in view properly into splunk index.ex-when there is more than 30k rows in views , a particular field is showing very minimum rows like 4k only, but the total count of index matches with the view as 30 k.
My question here is why a particular field gets minimum entries .I have recreated the index after deleting the old one ,but still facing the same issue .
Please help me with solution.
Is this v2? If so, Splunk HARD-CODED an arbitrary limit into dbxquery.py
. Here is another Q&A that shows how to bypass it:
https://answers.splunk.com/answers/233222/splunk-db-connect-2-dbxquery-only-returns-1001-row.html
Other than that, check the dbx2.log
(not automatically splunked):
http://docs.splunk.com/Documentation/DBX/2.2.0/DeployDBX/Troubleshooting