DB inputs are partially visible in Splunk DB connect GUI

[nishad_tupe]

I am creating the db_inputs.conf file using the python script that creates multiple database inputs with multiple queries.

However, whenever I place this files in the dir /opt/splunk/etc/apps/splunk_app_db_connect/local only last stanza is picked up by app and data is ingested only for last stanza for e.g.

Let's say I have 38 queries each (total 76) for 2 connections and have the following sequence in db_inputs.conf file

[input 1 ...]
[input 2...
[mssql:database:dm_db_fts_index_physical_stats]
description = Collect information for each full-text or semantic index in each table that has an associated full-text or semantic index
host = server1.com
connection = ProWatch_server1_1521
index = mssql
interval = 300
mode = batch
index_time_mode = current
query = SELECT *,CONVERT(varchar(128),SERVERPROPERTY('ServerName')) AS ServerName, db_name() AS DatabaseName FROM sys.dm_db_fts_index_physical_stats
sourcetype = mssql:database:dm_db_fts_index_physical_stats

And then, next stanza (last stanza)
[input 1...]
[input 2 ..]
[mssql:database:dm_db_fts_index_physical_stats]
description = Collect information for each full-text or semantic index in each table that has an associated full-text or semantic index
host = server2.com
connection = MS_server2_15959
index = mssql
interval = 300
mode = batch
index_time_mode = current
query = SELECT *,CONVERT(varchar(128),SERVERPROPERTY('ServerName')) AS ServerName, db_name() AS DatabaseName FROM sys.dm_db_fts_index_physical_stats
sourcetype = mssql:database:dm_db_fts_index_physical_stats

Then only last stanza is visible in splunk_db_connect GUI - inputs tab, which means I am able to see only inputs related to one connection whichever is placed later.

Do you know why such behavior? is there any restriction on the number of characters in db_inputs .conf?
inputs are identical for each connection so only for one connection is picked up?

Any help would be appreciated.

Regards,
Nishad

[nishad_tupe]

Thank you Ivan, yes you pointed right point. I was repeating my inputs name and that was the issue.
Actually, the requirements of my project provoked me to write a python script.
So I have to create 140 odd DB connections each with 40 queries, I tried bulk connect options of DB connect app it's not sufficient and still requires a lot of manual efforts.
The good part is script doesn't have any issues. It just needs additional logic to create a unique input name for each query/connection.

I appreciate you are taking the time and answering my question it is indeed a great help.

Regards,
Nishad

[ivanreis]

It is a pleasure share the knowledge. Happy Splunking!

[ivanreis · Accepted solution]

Per my understanding, the inputs should not have the same name. I never used the python script to create the db connections, but the issue here is you have identical names for inputs, then name each input using different names and there is no character limits per my knowledge.

https://docs.splunk.com/Documentation/DBX/3.1.4/DeployDBX/dbinputs