All Apps and Add-ons

splunk Dbconnect - index issue

DataOrg
Builder

i have 2 fields with open _issue_timestamp and closed_issue_issue.
when the ticket is opened the time will be updated in opened_issue and once action is taken the timestamp will be updated in closed_issue column later point of time.
so if we configure DB_input using ID it will not capture the closed_issue column when a new Ticket is opened ?
how to over come this issue?

0 Karma
1 Solution

nickhills
Ultra Champion

For updated rows to be processed by DBX you need a rising column value which changes whenever the row is updated.

Commonly, databases may have an "updated" column in which the timestamp or an incremental unique ID is modified whenever any other column in that record is amended.
If you have such a field in your database, you should use this value as the rising column, and sort the table results by "updated".

If your database does not have such a column, your choices are:
Have it introduced by the developers/dba
Use a batch process to import rows on a schedule - in many cases this will likely lead to some data duplication, so you will need to deduplicate, or otherwise handle this in Splunk

https://docs.splunk.com/Documentation/DBX/3.2.0/DeployDBX/Createandmanagedatabaseinputs

If my comment helps, please give it a thumbs up!

View solution in original post

0 Karma

nickhills
Ultra Champion

For updated rows to be processed by DBX you need a rising column value which changes whenever the row is updated.

Commonly, databases may have an "updated" column in which the timestamp or an incremental unique ID is modified whenever any other column in that record is amended.
If you have such a field in your database, you should use this value as the rising column, and sort the table results by "updated".

If your database does not have such a column, your choices are:
Have it introduced by the developers/dba
Use a batch process to import rows on a schedule - in many cases this will likely lead to some data duplication, so you will need to deduplicate, or otherwise handle this in Splunk

https://docs.splunk.com/Documentation/DBX/3.2.0/DeployDBX/Createandmanagedatabaseinputs

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...