All Apps and Add-ons

DB Connect and sourcetypes

Path Finder

Good evening,

I was using DB connect and it was forwarding events to my indexers, searches were working and everything was great,

However the DBA then cleaned the source DB the events were coming from and now my index is empty, no events and no sourcetype, ,

Therefore a few questions,

  1. Should I create my sourcetype on the SH as well as when its created on the HF (where DB Connect is installed).
  2. When the source DB is cleaned and all events removed is it expected behaviour that it would remove events from the Splunk Indexes as well ?



0 Karma


Dear rossparfect,
Answering your questions:
1 - the sourcetype have to be created on the HF where the DB Connect is installed, because it will be used to identify your data for the indexing pipeline.

2 - As far as I know, if the source DB table is cleaned it should not cleanup the splunk index because once the data is indexed you cannot change the data, although the retention/max volume parameters from the particular index is reached or someone cleanup all the events to the this particular index, thus the user have to have admin rights and splunk service must to be stopped to run the clean command. Per my knowledge, only dblookup function run the queries on the source DB tables, but did not index any data into splunk, it is being used to enrich data into splunk.
for further information about dblookup, check this document ->

I suggest for you to troubleshoot the dbconnect to identify the possible issue, please check this document ->

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...