All Apps and Add-ons

Splunk DB connect: How to use python sdk to change data_input status

DynaJim
Explorer

Hi All,

Befor I use DB connect plugin, I use python-sdk to check out disabled status of data_input, here is my code:

data_input = service.inputs[title]

# Print the input's current properties

    print "\nDisabled:", data_input["disabled"], " <--"

if data_input["disabled"] == '1':

    print "\nSince data input \"" + data_input.name + "\" is disabled(\"1\") now, enable the data port now..."

    # Modify a disabled

    kwargs = {"disabled": 0}

    # Update changes on the server

    data_input.update(**kwargs).refresh()

    # Display the new status

    print "\nDisabled:", data_input["disabled"], " <--"

else:

    pass

It's work and print:

Title: 10514
Connection_host: ip
Host: sdk-test-mod
Index: default
Sourcetype: syslog

Disabled: 1 <--

Since data input "10514" is disabled("1") now, enable the data port now...

Disabled: 0 <--

Since this case, I try to run my code to check out the disabled status of db connect, but I got this error:
http 500 bad request, feature "disabled" not supported from this handler.

Any way or suggestion I can debug?

Thank you!!

0 Karma
1 Solution

gjanders
SplunkTrust
SplunkTrust

I found that most of the REST inputs are disabled in DB Connect V3, are you also using DB Connect V3 ? You might want to have a quick read of https://answers.splunk.com/answers/516111/splunk-db-connect-v3-automated-programmatic-creati.html#an... if this is the case...

The 500 disabled implies it's not supported in the DB Connect version you are using..

View solution in original post

jkat54
SplunkTrust
SplunkTrust

This is saying that the db connect v2 data_input rest endpoint doesnt support a "disabled" function. Maybe they called it "enabled" or "disable", etc. Try browsing to the endpoint in chrome browser and see what options it supports.

DynaJim
Explorer

Thank you for your response, I have been try on "enabled" or "disabled", etc. It's not work 😞
Thank you very much!!

0 Karma

gjanders
SplunkTrust
SplunkTrust

I found that most of the REST inputs are disabled in DB Connect V3, are you also using DB Connect V3 ? You might want to have a quick read of https://answers.splunk.com/answers/516111/splunk-db-connect-v3-automated-programmatic-creati.html#an... if this is the case...

The 500 disabled implies it's not supported in the DB Connect version you are using..

DynaJim
Explorer

Hi Garethatiag, thank you for your response. Since I found "REST: inputs - disabled status" are disabled in DB Connect V3 also DB connect V2, I solve problem by follow your answer of Db connect V3, although my DB Connect is V2.
Thank you very much!!

0 Karma

gjanders
SplunkTrust
SplunkTrust

Converted to an answer so you can accept it if you wish 🙂

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...