All Apps and Add-ons

Splunk Add-On for MySQL (Splunk_TA_mysql) v2.0.2 - two errors in default/props.conf

chris_barrett
SplunkTrust
SplunkTrust

The default/props.conf for v2.0.2 of the add-on contains two issues - both of which are generating WARNING messages in splunkd.log

Issue #1
 
[mysql:errorLog:mysqld_safe]
EXTRACT-queries_in_queue = (?<queries_in_queue>[\.\d]+) queries \in queue

I believe that the slash before the in was an attempt to stop the "in queue" being treated as the 'regex in field' format of an EXTRACT.
 
I believe that the line should read:
EXTRACT-queries_in_queue = (?<queries_in_queue>[\.\d]+) queries\sin\squeue
 
Issue #2
 
[mysql:processInfo]
FIELDALIAS-cim_builder = thd_id AS process user AS user
 
Splunk was generating the following warning:
WARN  FieldAliaser - Invalid field alias specification in stanza 'mysql:processInfo': FIELDALIAS-cim_builder='thd_id AS process user AS user'

I believe it's because of the redundant 'host AS host' and removing it in a local/props.conf appears to have confirmed this.
0 Karma

artemrys
Splunk Employee
Splunk Employee

Hello @chris_barrett ,

We are working on a new release of Splunk Add-on for MySQL and those issues will be fixed there. 

0 Karma

artemrys
Splunk Employee
Splunk Employee

MySQL v3.0.0 is released.

0 Karma
Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...