All Apps and Add-ons

DB Connect ignoring rising column and pulls all rows after initial checkpoint value for every query.

att35
Builder

Hi,

I am using DB Connect V2(Configured on Indexer) to pull data from MSSQL Database with timestamp as the Rising Column. Data in the preview looks good but once the input is saved, each query pulls everything from the checkpoint timestamp onward instead of pulling only the rows that were added after the last updated checkpoint.

SELECT COLUMN1,
         COLUMN2,
         COLUMN3,
         COLUMN4,
         TIMESTAMP
FROM <Table_Name>
WHERE TIMESTAMP > ?
ORDER BY  TIMESTAMP DESC

alt text

Is there anything else I am missing in the configuration?

~ Abhi

0 Karma

Richfez
SplunkTrust
SplunkTrust

Shouldn't those be

ORDER BY <checkpointfieldname> ASC

?

I'd have to whip open my own DB connect to confirm, but hopefully that's all this is.

0 Karma

att35
Builder

To test, I edited the checkpoint value manually and set it to the current time. After saving, the input started working properly and checkpoint was getting updated with the latest data but after a while it again went back to the old checkpoint value I had set.

0 Karma

vsingla1
Communicator

@abhijittikekar I am also facing the same issue. Did you get a solution to your issue?

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...