All Apps and Add-ons

Splunk DB Connect: What does the "host" field mean in dbmon-dump stanza?

New Member

I am studying our Splunk configuration and I found the following stanza on our Splunk indexer. Can you please help me understand what does the host field indicate here? Note that 'host' value is different than indexer. It's the value of one of hosts in the same subnet with the universal forwarder. Also, we have all DB details in database.conf under /etc/apps/dbx/local/

host =
index = main
output.format = kv
output.timestamp = 1
sourcetype = mysourcetype
interval = 3600

Does that mean the dbmon-dump query will actually run on 'host'? Who will run that? Splunk Forwarder on 'host'?

0 Karma

Revered Legend

The dbmon dump will run on the Indexer (server which has the configuration inputs.conf), execute the query your specified, and attach the host metadata field as the value specified in the configuration inputs.conf and store in Splunk. You're basically overriding the host name, which will default to the server (indexer here) where the dbmon query is running. In general, the host name you specified will be the name of the database server.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...