If I disable, then reenable an input for the Splunk Add-on for ServiceNow, why is data loaded from the beginning instead of the last checkpoint date?

[wegscd]

I'm doing some testing on the Splunk Add-on for ServiceNow (and the Splunk App for ServiceNow).

I noticed that if I disable an input, then reenable it (without touching the checkpoint files), the TA will act like it had never been run before and extracting data for the newly enabled table from the beginning, instead of from the last checkpointed date.

Is this the design behaviour?

[cesaccenturefed]

The snow_config.py has an error check for the checkpoint file and when you disable the input and you run it again it look for conflicts and if it sees an existing file it cleans it and creates a new one.

WARNING pid=3297 tid=MainThread file=snow_config.py:remove_checkpoint:423 | Clean checkpoint file: /$splunkhome$/splunk/var/lib/splunk/modinputs/snow/cmn_location.sys_updated_on

your best bet is to grab the date in the check point file and add it as the since_when= date on the inputs.conf when you go to turn disable the input. then when you back to turn it on its already has the right date to look back to.

[jcoates_splunk]

That sounds like a bug... Have you set the date started from parameter? http://docs.splunk.com/Documentation/AddOns/latest/ServiceNow/Configureinputs

[wegscd]

If I do it works correctly. That means that the workaround is that if I decide to disable an input, I need to figure out what the proper date is to start picking up data again.

I think I would classify that as a bug. I can see if starting over from the beginning if I remove an input, but not if I disable it.