Hello
Im trying to create a DB Connect input to log the result of a query inside an index.
The query returns data as I can see when I execute it from Splunk however when I go to the Search I cant find anything in the index that I configured it.
1 - From the "DB Connect Input Health" I see no errors and it shows events from the input I created every x minutes (exactly as I configured it). It also shows this metric that also confirm that there are data been returned in the execution:
DBX - Input Performance - HEC Median Throughput
Search is completed 0.0465 MB
2 - From "index=_internal pg6 source="/opt/splunk/var/log/splunk/splunk_app_db_connect_server.log"" I can see that it:
Job 'my_input_name' started
Job 'my_input_name' stopping
Job 'my_input_name' finished with status: COMPLETED
3 - If I search the index I created for it, it is empty.
4 - splunk_app_db_connect 3.9.0
Thanks for any light!
I found the problem 🙂
When you select an index, by default you must select one of the indexes on that instance of Splunk Enterprise. This means that you cannot select an index that you have configured on a search peer but not distributed to the rest of the deployment.
The Indexes I tried to use were from indexer instance, not from the search instance.
Now I created the index in the search instance and I can see my data.