saving db connect tmp files

a212830 — Thu, 04 Apr 2013 18:30:49 GMT

I need to save the db connect tmp files for debugging purposes. Is there a way to tell db connect to save them?

Re: saving db connect tmp files

ziegfried — Fri, 05 Apr 2013 21:56:47 GMT

DB Connect creates a batch input for moving data to Splunk. The batch input is defined in $SPLUNK_HOME/etc/apps/dbx/local/inputs.conf

[batch://$SPLUNK_HOME/var/spool/dbmon/*.dbmonevt]
crcSalt = <SOURCE>
disabled = 0
move_policy = sinkhole
sourcetype = dbmon:spool

You can simply disable this input, then it won't be deleted (and indexed). To continue to index the data and still preserve the files, you could turn it into a regular file monitor:

[monitor://$SPLUNK_HOME/var/spool/dbmon/*.dbmonevt]
crcSalt = <SOURCE>
disabled = 0
sourcetype = dbmon:spool

Re: saving db connect tmp files

a212830 — Sat, 06 Apr 2013 00:11:03 GMT

Good stuff! Thanks.

topic saving db connect tmp files in Monitoring Splunk

saving db connect tmp files

Re: saving db connect tmp files

Re: saving db connect tmp files