Splunk DB Connect App and Splunk TA Oracle: Updating the checkpoint value for all inputs through conf file

[splunk4nisha]

I have tried using tail_rising_column_checkpoint_value in db_input.conf file but doesn't work.
Also, is there a way to avoid this in the future?

Checkpoint Value for Rising Column of END_TIME has set to default value of 1/1/1970 after Heavy Forwarder was restarted.

[harsmarvania57]

Hi,

Can you please let us know which version of DB Connect app are you using ?

[splunk4nisha]

Hi , we are using DB connect version : 3.1.2 and Splunk Enterprise version 7.1.2

[harsmarvania57]

Splunk DB Connect version 3 store checkpoint value in $SPLUNK_HOME/var/lib/splunk/modinputs/server/splunk_app_db_connect/ for every DB Input , if you want to reset checkpoint value you can modify your checkpoint file for particular DB Input(not db_inputs.conf) or use Splunk WebGUI to change checkpoint value.

[splunk4nisha]

Its strange that I only see files for two inputs there , the ones having problem are not even there.
If I create a file for the impacted input with one row only having the current timestamp, that should fix it?
Also, doing from the UI is time consuming there are 100's of input. Also I see the bulk option is not populating any values for rising column to select and hence cant use that.
Was just hoping for the quick way to get rid of this issue.

[harsmarvania57]

You can create checkpoint file on your own but filename must match with DB Input name, ordering of columns in checkpoint also matters and most important is columnType you need to provide correct number based on type of rising column.

This https://alvinalexander.com/java/edu/pj/jdbc/recipes/ResultSet-ColumnType.shtml might help for columnType.

[splunk4nisha]

thank you! However, it does not seems to be less time consuimg than the UI option. Do you know from where is splunk picking up the default time as 1/1/1970, I mean is if I can find the location from where it gets the default value, I can just go ahead and update that value.

[harsmarvania57]

Can you please provide log file which is stating that it is picking checkpoint value as 1/1/1970

[splunk4nisha]

I am not seeing any error log for this. But when we go to the corresponding input in data lab, it shows an alert message at the top saying : Error(s) occur when reading checkpoint.
And when you see at the right bottom at the checkpoint value field it shows value : 1/1/1970 00:00:00.000
which ideally does not show the value and rather shows an option to unlock and edit checkpoint value.