topic Re: DB Connect: I don't see any data after adding my database input in Splunk Search

DB Connect: I don't see any data after adding my database input

abassili — Mon, 28 Sep 2020 17:38:10 GMT

I have defined a database input (dump type) with a simple SQL query and a key-value output format. \

The "dbx.log" file shows that the query is running without any problems:

2014-09-19 11:06:08.426 dbx1788:INFO:ExecutionContext - Execution finished in duration=23 ms
2014-09-19 11:06:08.427 monsch2:INFO:Scheduler - Execution of input=[dbmon-dump://DB-SERVER/INPUT_SAMPLE_1] finished in duration=22 ms with resultCount=31 success=true continueMonitoring=true

The Splunk's \spool\dbmon directory has the the right csv_*.dbmonevt files.

Yet I don't see any data when I try to do the search. Even the source type is not there.

Am I missing a step in order for this to work?

Re: DB Connect: I don't see any data after adding my database input

dimoobraznii — Fri, 19 Sep 2014 16:06:23 GMT

Sometime you can get problems with license restrictions or can define index by default, if so, you could check main index.
In addition, check Activity->jobs.

Re: DB Connect: I don't see any data after adding my database input

abassili — Fri, 19 Sep 2014 16:12:14 GMT

Thanks ... I don't see any license alerts or violations and the volume that I have used today is way below the allowed daily volume. I checked "Activity->jobs", but I could not see any jobs there.

Re: DB Connect: I don't see any data after adding my database input

pradeepkumarg — Fri, 19 Sep 2014 17:48:00 GMT

Did you try just with the source filter and see?

source will be your dbmon input like below

source=dbmon-tail://*

Re: DB Connect: I don't see any data after adding my database input

abassili — Fri, 19 Sep 2014 17:57:14 GMT

Nothing shows up ...

Even when I try source=dbmon-tail://...., there is nothing there.

Splunk does not even recognize this source or sourcetype.

Re: DB Connect: I don't see any data after adding my database input

pradeepkumarg — Fri, 19 Sep 2014 18:28:42 GMT

the index that you specified in your database inputs, did you create that index in indexes.conf?

Re: DB Connect: I don't see any data after adding my database input

abassili — Fri, 19 Sep 2014 18:35:00 GMT

I am using the deafult index (Splunk Index: index). I suppose that is already defined.

Re: DB Connect: I don't see any data after adding my database input

pradeepkumarg — Fri, 19 Sep 2014 19:15:03 GMT

I don't think there is any index which is called as 'index', you can try 'main' index or create your own index and then configure dbinputs for that index .

Re: DB Connect: I don't see any data after adding my database input

abassili — Fri, 19 Sep 2014 19:28:18 GMT

Thanks, I changed the index to main but sill no luck. Do I need to configure the index I create? Where should I do that? I see the "inputs.conf". Is that the one?

Re: DB Connect: I don't see any data after adding my database input

pradeepkumarg — Fri, 19 Sep 2014 19:34:23 GMT

After you change the index to main, you have to make sure new events are returned for your query. I would suggest creating a new database inputs rather than modifying the existing one.

Re: DB Connect: I don't see any data after adding my database input

abassili — Mon, 28 Sep 2020 17:38:32 GMT

Where can I find that file index.conf?

I have deleted the old database input and created a new one (index = input1).

Here's the the inputs.conf (I have not changed anything there):

JBridge Server script

[script://./bin/jbridge_server.py]
index = input1
sourcetype = dbx_jbridge
interval = 0
disabled = false
passAuth = splunk-system-user
[script://.\bin\jbridge_server.py]
index = input1
sourcetype = dbx_jbridge
interval = 0
disabled = false
passAuth = splunk-system-user

Are there any files that I need to add that index to?

This is still not working. I got nothing with the search inddex = "input1"

Thanks a lot for your help. I think I'm getting closer.

Re: DB Connect: I don't see any data after adding my database input

pradeepkumarg — Fri, 19 Sep 2014 20:23:44 GMT

If you want to create a index as "input1" you have to create it in indexes.conf. More details here
http://docs.splunk.com/Documentation/Splunk/6.1.3/admin/Indexesconf

topic Re: DB Connect: I don't see any data after adding my database input in Splunk Search

DB Connect: I don't see any data after adding my database input

Re: DB Connect: I don't see any data after adding my database input

Re: DB Connect: I don't see any data after adding my database input

Re: DB Connect: I don't see any data after adding my database input

Re: DB Connect: I don't see any data after adding my database input

Re: DB Connect: I don't see any data after adding my database input

Re: DB Connect: I don't see any data after adding my database input

Re: DB Connect: I don't see any data after adding my database input

Re: DB Connect: I don't see any data after adding my database input

Re: DB Connect: I don't see any data after adding my database input

Re: DB Connect: I don't see any data after adding my database input

Copyright (C) 2005-2014 Splunk Inc. All Rights Reserved.

JBridge Server script

Re: DB Connect: I don't see any data after adding my database input