All Apps and Add-ons

How to collect spool (.dbmonevt) files in db connect 1.x for support trouble shooting?

splunkIT
Splunk Employee
Splunk Employee

Support would like to obtain .dbmonevt spool files in order to further trouble shoot my db connect 1.x issue. What are the steps to collect these files?

0 Karma
1 Solution

splunkIT
Splunk Employee
Splunk Employee

Here are the steps:

  1. Disable all your dbmon-tail or dbmon-dump inputs from the DB Connect app UI (http://hostname:8000/en-US/manager/dbx/dbx/dbmon)
  2. Ensure that there is no .dbmonevt file exist in $SPLUNK_HOME/var/spool/dbmon/ directory
  3. Disable batch input for $SPLUNK_HOME/var/spool/dbmon/*.dbmonevt from splunk UI (http://hostname:8000/en-US/manager/dbx/data/inputs/monitor).
  4. Now, ONLY re-enable that dbmon-tail or dbmon-dump input from the DB Connect app UI (http://hostname:8000/en-US/manager/dbx/dbx/dbmon) that you need to troubleshoot.
  5. Once the input is executed, you should see .dbmonevt files in $SPLUNK_HOME/var/spool/dbmon/
  6. Make copies of these .dbmonevt files, and attach them to the support case
  7. Re-enable all the disabled inputs done in steps #1 and #3

View solution in original post

splunkIT
Splunk Employee
Splunk Employee

Here are the steps:

  1. Disable all your dbmon-tail or dbmon-dump inputs from the DB Connect app UI (http://hostname:8000/en-US/manager/dbx/dbx/dbmon)
  2. Ensure that there is no .dbmonevt file exist in $SPLUNK_HOME/var/spool/dbmon/ directory
  3. Disable batch input for $SPLUNK_HOME/var/spool/dbmon/*.dbmonevt from splunk UI (http://hostname:8000/en-US/manager/dbx/data/inputs/monitor).
  4. Now, ONLY re-enable that dbmon-tail or dbmon-dump input from the DB Connect app UI (http://hostname:8000/en-US/manager/dbx/dbx/dbmon) that you need to troubleshoot.
  5. Once the input is executed, you should see .dbmonevt files in $SPLUNK_HOME/var/spool/dbmon/
  6. Make copies of these .dbmonevt files, and attach them to the support case
  7. Re-enable all the disabled inputs done in steps #1 and #3
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...