I am attempting to upgrade from Splunk DB Connect v1 to v2, but running into a problem with my first ever input.
Everything looks fine and is set up. Marked as a Valid Connection, and I can save it, but about 1 min later, the status will change from Enabled to Disabled.
Looking at the errors, I see that the function "pydbinfo:getcatalogs" goes into an error state whenever this happens.
I can query the database fine from within the app. When setting up the input, it shows me the first 100 lines fine. Just seems to error for just about no reason that I can see.
Do the following:
index=_internal sourcetype=dbx2 CRITICAL | top action
And i am betting that you will be getting some sort of error about your data.... I am troubleshooting the same thing right now.
For some reason a dbx2 upgrade (2.2.0) is no longer using my epoch timestamps correctly..... its truncating them in a very weird way....
Just as an FYI you will see that your connection is being disabled automatically using the following search
index=_internal sourcetype=dbx2 action=auto_disable_modular_input_due_to_maximum_failed_retries
Thank you, this is giving me much more to work with.
I've got a SQL server that keeps cutting out for various reasons. The second of jtrujillo's queries above is easily turned into an alert that can tell you when an input has been disabled when something like that occurs. Very helpful!
This indeed helpful.
How do we stop the connection getting disabled though?
Further to what @jtrujillo said.
Search for db inputs which are getting disabled using the query:
index=internal sourcetype=dbx2 action=autodisablemodularinputduetomaximumfailed_retries
Once you have the db inputs, go to inputs.conf file and check for those 2 db inputs:
You'll have to change following parameter to ensure its not getting auto disabled.
auto_disable = (true|false)
If you really want, you can change this setting as well.
I am facing the same problem, but not with all the data inputs. If the data input is created with input type=tail then it is facing some problem. Should i check with the query or can i proceed with changing the input.conf files. ,I am facing the same problem, but not with all the data inputs. If i am duplication a data input with input type=tail. Should i try and change the query accordingly or is there any other solution!!