All Apps and Add-ons

Splunk DB connect: How to use python sdk to change data_input status

DynaJim
Explorer

Hi All,

Befor I use DB connect plugin, I use python-sdk to check out disabled status of data_input, here is my code:

data_input = service.inputs[title]

# Print the input's current properties

    print "\nDisabled:", data_input["disabled"], " <--"

if data_input["disabled"] == '1':

    print "\nSince data input \"" + data_input.name + "\" is disabled(\"1\") now, enable the data port now..."

    # Modify a disabled

    kwargs = {"disabled": 0}

    # Update changes on the server

    data_input.update(**kwargs).refresh()

    # Display the new status

    print "\nDisabled:", data_input["disabled"], " <--"

else:

    pass

It's work and print:

Title: 10514
Connection_host: ip
Host: sdk-test-mod
Index: default
Sourcetype: syslog

Disabled: 1 <--

Since data input "10514" is disabled("1") now, enable the data port now...

Disabled: 0 <--

Since this case, I try to run my code to check out the disabled status of db connect, but I got this error:
http 500 bad request, feature "disabled" not supported from this handler.

Any way or suggestion I can debug?

Thank you!!

0 Karma
1 Solution

gjanders
SplunkTrust
SplunkTrust

I found that most of the REST inputs are disabled in DB Connect V3, are you also using DB Connect V3 ? You might want to have a quick read of https://answers.splunk.com/answers/516111/splunk-db-connect-v3-automated-programmatic-creati.html#an... if this is the case...

The 500 disabled implies it's not supported in the DB Connect version you are using..

View solution in original post

jkat54
SplunkTrust
SplunkTrust

This is saying that the db connect v2 data_input rest endpoint doesnt support a "disabled" function. Maybe they called it "enabled" or "disable", etc. Try browsing to the endpoint in chrome browser and see what options it supports.

DynaJim
Explorer

Thank you for your response, I have been try on "enabled" or "disabled", etc. It's not work 😞
Thank you very much!!

0 Karma

gjanders
SplunkTrust
SplunkTrust

I found that most of the REST inputs are disabled in DB Connect V3, are you also using DB Connect V3 ? You might want to have a quick read of https://answers.splunk.com/answers/516111/splunk-db-connect-v3-automated-programmatic-creati.html#an... if this is the case...

The 500 disabled implies it's not supported in the DB Connect version you are using..

DynaJim
Explorer

Hi Garethatiag, thank you for your response. Since I found "REST: inputs - disabled status" are disabled in DB Connect V3 also DB connect V2, I solve problem by follow your answer of Db connect V3, although my DB Connect is V2.
Thank you very much!!

0 Karma

gjanders
SplunkTrust
SplunkTrust

Converted to an answer so you can accept it if you wish 🙂

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out &gt;&gt; As our brave ...