Hi,
Id like to query an ORACLE for data until the last 3 hours (business need / processing time) and also check from the last incremental ID.
All our Splunks and DB Connect are on the last version.
Currently DATE with WHERE and TAIL RISINIG column are loosing data.
Is it possible?
What's the best approach?
Thanks.
[mi_input://oracle_XXXX_OPE_LOG]
query = SELECT * FROM XXXX WHERE DT_INI_EXE <= (sysdate-3/24)
disabled = 0
connection = oracle_XXXX
description = oracle_XXXX
index = edenred_XXXX
input_timestamp_column_name = DT_INI_EXE
interval = 60
max_rows = 50000
mode = tail
sourcetype = XXXX_OPE_LOG
tail_follow_only = 1
tail_rising_column_name = CD_MON_OPE_LOG
tail_rising_column_number = 1
ui_query_mode = advanced
output_timestamp_format = yyyy-MM-dd HH:mm:ss.SSS
↧