Does Splunk DBConnect's checkpoint file rotate?

[msellery1619]

I understand that in DBConnect 3, the checkpoint file that tracks the Rising Column value is now stored in files under /opt/splunk/var/lib/splunk/modinputs/server/splunk_app_db_connect.

However, do these files rotate? They will get quite large after just a few months. Isn't the last timestamp the only timestamp that should matter in this file? Why is every timestamp stored? Thanks!

[jcoates · Accepted solution]

the checkpoint files do rotate -- I don't recall the size and time limits for individual files, but there's a maximum of 100MB for the entire folder.

[msellery1619]

Thanks! I won't be in a position to test this with my own eyes for a while, but I'll take this at face value and consider it answered. Do you happen to know if the current file is always named the exact same file name? Thanks!

[jcoates]

yes, it's based on the input name. It'll always be the same file, the rotation is just to drop old lines and add new ones. It doesn't gzip off old copies.

[harsmarvania57]

@jcoates is right, I was wrong. While looking at db_inputs.conf.spec the configuration is available to setup checkpoint file size but I never tested this.

max_single_checkpoint_file_size = <integer>
# optional
# Max checkpoint file size before archiving checkpoint file in bytes.  Default is 10MB, max is 100MB.

[bschaap]

I'm unable to get DB Connect to honor this setting and it's not rotating files larger than the max file size. I have tried using both the default size and the specifying the max size but neither work.

I am interested in whether this works or does not work for others.