Splunk DBconnect interval question

[mwdbhyat]

Hi there,

If I want dbconnect to continuously and instantly read a DB do I just set the interval to 0 - are there any implications to doing this, such as large performance overheads?

Thanks!

[jcoates]

1. It's a batch input, not a stream, so you can't really do what you're describing at all. If you want streaming behavior the source has to support that also, and DBX's Java layer would need to be modified.
2. yes, there would be performance implications of batching very quickly. You want to consider how rapidly the data you want arrives in the database, and how long it takes the database to respond to your query. Then set execution time to be a little slower than that. This is a balancing act for batch jobs because the longer you wait the more rows there are to return, but if you go too fast your connection setup is going to be more expensive than your data movement.

[mchang_splunk · Accepted solution]

By referring to document:
http://docs.splunk.com/Documentation/DBX/3.1.2/DeployDBX/Createandmanagedatabaseinputs#Parameter_set...

The minimum interval is 1 minute:
Execution Frequency: The number of seconds or a valid cron expression i.e. 0 18 * * * (every day at 6PM).