DB Connect Tail Not Keeping Up With Log Volume

[dflodstrom]

We have a dbconnect (v1.2.2) input that is failing to keep up with log volume. We this feed spikes once every couple of weeks and after the spike the event feed almost stops. It usually 'fixes' itself after a restart of splunkd or the server itself.

Looking at dbx.log I can see the connection to the db being made and that it is retrieving a couple of events at a time. The poll frequency is set to auto and I see the connection being made frequently.

Has anyone experienced a similar issue? Any idea what we might do to get it going again?

[mdsnmss]

It doesn't appear this applies to v1.2.2 since that is a bit out of date but I do know in version of 2.x.x there are settings called "Max Rows to Retrieve" and "Fetch Size". I believe default for "Max Rows to Retrieve" is 10000 and "Fetch Size" is 300. Based on documentation there is a pretty good difference between 1.2.2 and 2.0.0.

https://docs.splunk.com/Documentation/DBX/1.2.2/DeployDBX/Configuredatabasemonitoring
https://docs.splunk.com/Documentation/DBX/2.0.0/DeployDBX/Createandmanagedatabaseoutputs

Looking at 1.2.2 docs I am not seeing a setting in the inputs.conf file that would relate to those settings that are introduced in 2.0.0 making it appear it just attempts to grab all new entries from the latest value retrieved in the rising column. You could play with the cron interval the grab is scheduled to pull at to see if breaking it up into more manageable queries for DBConnect helps. I'm not sure the frequency setting it to "auto" would produce as it is dependent on volume. Looking at the inputs.conf for version 1.X the setting options seem to be severely limited.

I'd recommend upgrading to a more current version if possible as 1.X is also end of life as of July, 2016. The are some optimizations that speed up these returns and more customization in later releases. It seems your DB may be producing events faster than DBConnect can keep up with at that version.