All Apps and Add-ons

DBXConnet 3.1.1 losing some of the rows - troubleshooting

piotrgalas
Explorer

Hello,

I have a situation where I have an input that is losing some of the rows. The connection works stable. The input is executed every 5 minutes and defined with rising column on “LASTMODIFIED” (DateTime) column with ">=?" to avoid lost rows, order ASC. Vast majority of rows is indexed correctly but few are not. Interestingly when I use SQL Explorer I retrieve the rows without any problem. I have created special input that was 100% the same as the original one + had “and ID=123” in SQL query limiting the ingest to the one of the interesting rows only. It worked like charm. Answering question before asked – I cannot use any different column to be rising one (hence “>=” not the typical “>” in SQL query). Moreover, I have checked and found out that the missing “123 row” has no twin row with the same “LAST MODIFIED” value.
1. I am looking for ways of troubleshooting it. I tried to increase logging to DEBUG but I drown in the amount of logs and was unable to find anything that would be helpful in the obvious way – I was hoping for results of each row parsing, no luck…
2. If anyone can suggest possible causes that are not covered by “>=” trick I would also truly appreciate.

Thank you in advance 🙂

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...