I am running version 2.3.0 and have a problem I would like to work around.
When one of my DB servers gets taken offline for maintenance, and there is a Splunk DB Connect operation that would access it, and that operation gets set to Disabled at some point. That makes sense.
Due to some quirk / defect, my Heavy Forwarder where DB Connect is running will stop running DB Connect all together. So I have added a nightly Splunk restart task, and that keeps it healthy enough for my needs right now.
That said, if I have disabled operations, I would like then to be re-enabled on a restart of DB Connect. Is that even possible? Or will manual intervention be required every time?
Hey there,
DB Connect automatically disables inputs when the connection cannot be made to the database after 6 retries.
Have you thought about disabling that functionality, so they will not auto disable?
In your inputs.conf
[my_input]
...
auto_disable = false
http://docs.splunk.com/Documentation/DBX/2.4.0/DeployDBX/inputsspec
I think this should work for you.
Thanks
I would suspect 'no'. It is a configuration file change and it only impacts DBConnect. So you would need a DB Connect task of some sort that can parse its own inputs file and determine which type of input doesn't have the desired key.
I have no idea if you can write a DBConnect task that probes the running state of DBConnect.
Hey there,
DB Connect automatically disables inputs when the connection cannot be made to the database after 6 retries.
Have you thought about disabling that functionality, so they will not auto disable?
In your inputs.conf
[my_input]
...
auto_disable = false
http://docs.splunk.com/Documentation/DBX/2.4.0/DeployDBX/inputsspec
I think this should work for you.
Thanks
Outstanding. Thank you.
Interestingly buried quite deep in the example config file.
Is there a was to set up a alert that will tell you have input was auto disabled? I would like set one up to ensure we do not drop a connection if someone forgets to set auto_disable = false.