All Apps and Add-ons

Splunk DB Connect App and Splunk TA Oracle: Updating the checkpoint value for all inputs through conf file

splunk4nisha
New Member

I have tried using tail_rising_column_checkpoint_value in db_input.conf file but doesn't work.
Also, is there a way to avoid this in the future?

Checkpoint Value for Rising Column of END_TIME has set to default value of 1/1/1970 after Heavy Forwarder was restarted.

0 Karma

harsmarvania57
Ultra Champion

Hi,

Can you please let us know which version of DB Connect app are you using ?

0 Karma

splunk4nisha
New Member

Hi , we are using DB connect version : 3.1.2 and Splunk Enterprise version 7.1.2

0 Karma

harsmarvania57
Ultra Champion

Splunk DB Connect version 3 store checkpoint value in $SPLUNK_HOME/var/lib/splunk/modinputs/server/splunk_app_db_connect/ for every DB Input , if you want to reset checkpoint value you can modify your checkpoint file for particular DB Input(not db_inputs.conf) or use Splunk WebGUI to change checkpoint value.

0 Karma

splunk4nisha
New Member

Its strange that I only see files for two inputs there , the ones having problem are not even there.
If I create a file for the impacted input with one row only having the current timestamp, that should fix it?
Also, doing from the UI is time consuming there are 100's of input. Also I see the bulk option is not populating any values for rising column to select and hence cant use that.
Was just hoping for the quick way to get rid of this issue.

0 Karma

harsmarvania57
Ultra Champion

You can create checkpoint file on your own but filename must match with DB Input name, ordering of columns in checkpoint also matters and most important is columnType you need to provide correct number based on type of rising column.

This https://alvinalexander.com/java/edu/pj/jdbc/recipes/ResultSet-ColumnType.shtml might help for columnType.

0 Karma

splunk4nisha
New Member

thank you! However, it does not seems to be less time consuimg than the UI option. Do you know from where is splunk picking up the default time as 1/1/1970, I mean is if I can find the location from where it gets the default value, I can just go ahead and update that value.

0 Karma

harsmarvania57
Ultra Champion

Can you please provide log file which is stating that it is picking checkpoint value as 1/1/1970

0 Karma

splunk4nisha
New Member

I am not seeing any error log for this. But when we go to the corresponding input in data lab, it shows an alert message at the top saying : Error(s) occur when reading checkpoint.
And when you see at the right bottom at the checkpoint value field it shows value : 1/1/1970 00:00:00.000
which ideally does not show the value and rather shows an option to unlock and edit checkpoint value.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...