I use DBconnect, when I update the data in the database, a fault occurs, the inside of the Splunk display information and database display different.
In the database.
mysql> update updatetest set ID=ID+1;
mysql> select * from updatetest;
+------+------+
| ID | name |
+------+------+
| 2 | jim |
| 3 | anny |
+------+------+
2 rows in set (0.00 sec)
on my splunk
search index=updatetest 13-12-5 下午07时12分19.000秒 id=3 name=anny host = localhost source = dbmon-tail://updatetest/updatetest sourcetype = updatetest
13-12-5 下午07时07分05.000秒 id=2 name=anny host = localhost source = dbmon-tail://updatetest/updatetest sourcetype = updatetest
13-12-5 下午07时07分05.000秒 id=1 name=jim host = localhost source = dbmon-tail://updatetest/updatetest sourcetype = updatetes
I don't know why, I hope someone can help me