topic Re: Issue with db connect indexing in Splunk Dev

Issue with db connect indexing

vaibhavagg2006 — Fri, 15 Nov 2013 06:02:07 GMT

Hi,
I am trying to index data from sql server. I am able to fetch the data using dbquery but not able to add data to index, I have used following configurations in inputs.conf. I have tried to add data to default index as well as custom index. But no success. Please provide your inputs
Sample data

2   abc rcl


[script://$SPLUNK_HOME\etc\apps\dbx\bin\jbridge_server.py]
disabled = 0

[batch://$SPLUNK_HOME\var\spool\dbmon\*.dbmonevt]
crcSalt = <SOURCE>
disabled = 0
move_policy = sinkhole
sourcetype = dbmon:spool

[dbmon-dump://test_ext_db/sql]
index = vaibhav
output.format = kv
output.timestamp = 0
query = select * from table_splunk
sourcetype = db
table = table_splunk
host = chdsez203099d
interval = auto

[dbmon-tail://test_ext_db/dbinput]
output.format = kv
output.timestamp = 0
query = SELECT * FROM table_splunk {{WHERE $rising_column$ > ?}} \r\n\r\n
table = table_splunk
tail.rising.column = id

Re: Issue with db connect indexing

vaibhavagg2006 — Sat, 16 Nov 2013 18:19:59 GMT

any help??

Re: Issue with db connect indexing

ziegfried — Sat, 16 Nov 2013 20:43:19 GMT

Any errors in $SPLUNK_HOME/var/log/splunk/dbx.log?

Re: Issue with db connect indexing

vaibhavagg2006 — Sun, 17 Nov 2013 17:36:56 GMT

no errors surprisingly and resultcount in logs is also coming correct.continue monitoring is also true...

Re: Issue with db connect indexing

rsennett_splunk — Sun, 17 Nov 2013 21:01:59 GMT

I wonder if your testing has caused the checkpoint to think it's already updated...

http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Troubleshoot#Input_not_updating

Re: Issue with db connect indexing

vaibhavagg2006 — Mon, 18 Nov 2013 06:07:58 GMT

checked the checkpoint. itis fine..and dump is also not working.
Splunk version is 5.0.1 and dbx version is 1.0.8

Re: Issue with db connect indexing

vaibhavagg2006 — Mon, 28 Sep 2020 15:18:08 GMT

is there any way i can check whether there is any error when splunk is trying to index this data?
It has created a file kv_1384758521635957316.dbmonevt in var\spool\dbmon and has following content. but it is not seen in the index.
SPLUNK host=chdsez203099d source="dbmon-dump://ext_db/db_dump" sourcetype="dbmon:kv" index=default
2013-11-18T12:38:41.609 id=1 name=xxx dept=cl
2013-11-18T12:38:41.633 id=2 name=abc dept=rcl
2013-11-18T12:38:41.633 id=3 name=yyy dept=pl

Re: Issue with db connect indexing

vaibhavagg2006 — Wed, 20 Nov 2013 10:09:44 GMT

the files are still there in spool\dbmon.. it means batch input is not working. Splunkd also doesnot contains any related errirs

Re: Issue with db connect indexing

jcoates_splunk — Wed, 20 Nov 2013 14:53:46 GMT

Latest db connect is always a good idea (1.1.1). Also check dbx.log.

Re: Issue with db connect indexing

vaibhavagg2006 — Wed, 20 Nov 2013 17:46:49 GMT

Hi,
I updated the dbx yesterday. Still facing the issue.
Files are getting created in the spool\dbmon but not getting indexed and deleted. No suspicious log in dbx log.
splunkd sometimes contains errors which says db lookups not found..but i dont think it matters