If your data status changes at the backend, it is always better to use full refresh rather than Incremental Extract, because if you would do increment on dates, latest data would be appended, but if there is some change in the earlier data, you won't be able to capture them, Secondly, If your date has Datetime format, then also you are likely to have errors. So, better go for full extract in your case.
One date field coming from Splunk is in date format while the other is string that i convert to date time in tableau. I was not even worried about which refresh to to go until i started seeing the jump in the groups of the histogram from 500, 600 to 3 K 6 K. I am still trying to think what is the issue that is causing it. Do have any idea? I just click "Refresh" and save it once the Live data can be seen.