Database Collector Repeats Rows When State Tracking Does Not Match the Query with Cribl Stream

Symptom

A scheduled Database Collector returns the same rows repeatedly, often exactly at its page or batch limit, even though each job completes successfully. The saved state does not advance as expected.

Environment

• Cribl Stream
• Scheduled Database Collector
• State tracking enabled
• Incremental SQL query using a saved state value

Resolution

1. Identify the configured state-tracking column.
2. Verify that the query returns the same column name used by Tracking Column.
3. Verify that any SQL alias matches the configured tracking column exactly.
4. Update the WHERE expression to reference the matching saved-state property.
5. Use a numeric or string tracking value that increases monotonically.
6. Add an explicit ORDER BY for the tracking value.
7. Save and deploy the collector configuration.
8. Monitor two or three scheduled runs in Job Inspector.
9. Verify that the saved state increases between successful runs.
10. Verify that event counts fall below the page limit after any backlog is cleared.

Cause

This issue can occur when:

• The query references a saved-state property that does not match the configured tracking column.
• The query alias differs from the configured tracking-column name.
• The tracking value is not supported by the collector.
• The query does not return rows in ascending tracking order.
• An existing backlog is large enough to fill every collection page.

Additional Information

An exact page-limit result on every scheduled run is a signal to inspect state tracking and backlog depth. Use the supported Cribl state-management workflow when a collector must start from an approved point in history.