Automatic deactivation of DB inputs to lose the connection to the database - DB Connect V2

[roberto_mendes]

Hello guys.

Recently that made the update Splunk App DB Connect V2 to version 2.2.0. App really has improved with each new update. However, we have identified in this latest version that whenever the instance of Splunk lost the connection to the database (Oracle), the DB inputs are automatically disabled. As our Splunk instance is in a different Data Center database instance, this connection loss may occur several times throughout the month.

After much analysis, we identified that as from version 2.1.2 was implemented the command "auto_disable = true" by default in inputs.conf. We managed to solve the problem by entering the command "auto_disable = false" the bottom of each stanza in the inputs.conf. Example:

[mi_input://your_db_input]
connection = oracle_system_dba
index = oracle
interval = 300
max_rows = 10000
mode = batch
output_timestamp_format = epoch
query = "your_query"
resource_pool = local
source = dbx
SourceType = oracle: lockSession
ui_query_catalog = NULL
ui_query_mode = advanced
ui_query_schema = undefined
ui_query_table = undefined
auto_disable = false

I would just leave it documented if anyone has experienced a similar problem after upgrading the DB Connect V2.

Regards,

Roberto Mendes.

[jtrujillo]

Sounds like you can set it globally by doing this:

[mi_input://default]
auto_disable = false