All Apps and Add-ons

Splunk DB Connect -- How can I figure out who disabled indexes in the app?

Path Finder

Hi ,

I am currently facing the issue like ,

My indexes created in Splunk DB Connect have been disabled by some means or someone accidentally.
I need to find out the person who disabled this, or how it got disabled. It will be working fine for many days, but suddenly it will be disabled one day and we can't figure it out.

Can someone help me in this to find the person or means it is disabled.

Regards,
Sundar

0 Karma

Influencer

Do you mean the actual DB inputs get disabled ? If the the connection to database fails for x amount of tries, the inputs gets disabled automatically. The number of tries can be configured per input. If this is the case, you can find the event in the dbx logs which says when the input was actually disabled.

0 Karma

Path Finder

I think this happend in my case.

Thank you,

0 Karma

SplunkTrust
SplunkTrust

Hi @umsundar2015,

If someone disabled Indexes via SplunkWeb then you will able to find details using below query.

index=_internal host=<HOSTNAME ON WHICH DB CONNECT RUNNING> source=*splunkd_ui_access.log* POST disable

I hope this helps.

Thanks,
Harshil

0 Karma