All Apps and Add-ons

Rising column not working with Netezza connection

patouellet
Path Finder

Hi,

First I just want to say we are using DB Connect and DB Inputs with Rising columns extensively with DB2, Oracle and SQL Server database types - all without issues.

But recently we've been trying to setup a DB Input with Netezza database and the rising column is not working - not doing what it's supposed to be doing. I have a DB Input setup to run every 5 minutes and it pulls the same record everytime. Looking at the TIME column I am using as a rising column, and the checkpoint value Splunk DBConnects uses, it looks like the checkpoint value isn't precise enough to make the where statement work as intended.

The query is:

 SELECT * 
    FROM "HISTDBV3"."HISTUSR"."$hist_failed_authentication_3"
    WHERE TIME > ?
    ORDER BY TIME ASC

The value of the TIME column is:

2020-03-10 19:34:04.884102

The checkpoint value is (according to the Edit Input interface):

3/10/2020 19:34:04.884

So of course if with statement "WHERE TIME > ?" then it is always true (19:34:04.884102 > 19:34:04.884).

Looks like a bug to me. Anyone experienced this?

Thanks.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...