For the benefit of the community I put this as an answer to my own question.
This most likely is a bug in Splunk DB Connect (DBX) 1.1.3. I was able to reproduce the issue on several systems and against several SQL SERVER 2008. I ended up creating two inputs that only differ in target index name and rising column: int and datetime. The SQL is simple and only select a few small columns. Again int as rising column worked fine but datetime only gave partial data after initial loading. No error in dbx.log in both cases. Tweaking parameters like interval, batch size, etc. would not help. I did not want to test bigint again as it was the initial problem I had.
If I make an int column by converting the bigint timestamp to int, CONVERT(int, dt/1000), it works but it still has potential of losing data as by conversion precision is lost. In addition, it takes a performance hit as now the where clause is essentially a function. For a small table like mine it works ok so far.
... View more