Splunk DB Connect 2.3.0: How to automatically re-enable DBX operations after restarting the app?

[bsherwoodofdapt]

I am running version 2.3.0 and have a problem I would like to work around.
When one of my DB servers gets taken offline for maintenance, and there is a Splunk DB Connect operation that would access it, and that operation gets set to Disabled at some point. That makes sense.

Due to some quirk / defect, my Heavy Forwarder where DB Connect is running will stop running DB Connect all together. So I have added a nightly Splunk restart task, and that keeps it healthy enough for my needs right now.

That said, if I have disabled operations, I would like then to be re-enabled on a restart of DB Connect. Is that even possible? Or will manual intervention be required every time?

[bsherwoodofdapt]

I would suspect 'no'. It is a configuration file change and it only impacts DBConnect. So you would need a DB Connect task of some sort that can parse its own inputs file and determine which type of input doesn't have the desired key.

I have no idea if you can write a DBConnect task that probes the running state of DBConnect.

[ktugwell_splunk · Accepted solution]

Hey there,

DB Connect automatically disables inputs when the connection cannot be made to the database after 6 retries.

Have you thought about disabling that functionality, so they will not auto disable?

In your inputs.conf

 [my_input]
 ...
 auto_disable = false

http://docs.splunk.com/Documentation/DBX/2.4.0/DeployDBX/inputsspec

I think this should work for you.

Thanks

[bsherwoodofdapt]

Outstanding. Thank you.

Interestingly buried quite deep in the example config file.

[sbattista09]

Is there a was to set up a alert that will tell you have input was auto disabled? I would like set one up to ensure we do not drop a connection if someone forgets to set auto_disable = false.