How to collect spool (.dbmonevt) files in db connect 1.x for support trouble shooting?

[splunkIT]

Support would like to obtain .dbmonevt spool files in order to further trouble shoot my db connect 1.x issue. What are the steps to collect these files?

[splunkIT · Accepted solution]

Here are the steps:

1. Disable all your dbmon-tail or dbmon-dump inputs from the DB Connect app UI (http://hostname:8000/en-US/manager/dbx/dbx/dbmon)
2. Ensure that there is no .dbmonevt file exist in $SPLUNK_HOME/var/spool/dbmon/ directory
3. Disable batch input for $SPLUNK_HOME/var/spool/dbmon/*.dbmonevt from splunk UI (http://hostname:8000/en-US/manager/dbx/data/inputs/monitor).
4. Now, ONLY re-enable that dbmon-tail or dbmon-dump input from the DB Connect app UI (http://hostname:8000/en-US/manager/dbx/dbx/dbmon) that you need to troubleshoot.
5. Once the input is executed, you should see .dbmonevt files in $SPLUNK_HOME/var/spool/dbmon/
6. Make copies of these .dbmonevt files, and attach them to the support case
7. Re-enable all the disabled inputs done in steps #1 and #3