All Apps and Add-ons

Splunk dbconnect: all the search heads are fetching and writing data

dantonag
Explorer

Hello,

we have 4 search heads on our installation of Splunk 6.5.1, with DBConnect 2.4.0.

Suddenly, all the search heads started feeding data into Splunk via DBConnect, while, some days ago, only one of the search heads per time was executing the scheduled query and writing on the database.

What can we check to avoid this behavior (that puts 4x data on the index)?

Thanks

Labels (1)
0 Karma

Terpz
Loves-to-Learn Lots

DBconnect < 3.x allows for scheduled inputs via search head cluster. 

Maybe an issue with who is the captain?
Is dbconnect the only issue?

0 Karma

dantonag
Explorer

Hello,

as far as we could investigate, only dbconnect is giving problems (fetching 4x times the data, instead of doing only one fetch from the database). Note, as I said, that this problem started two days ago after this system has been working for years without problems. Noone seems to have touched the configuration, though.

Thanks

0 Karma

somesoni2
SplunkTrust
SplunkTrust

How are you ingesting data from Splunk, using data inputs? AFAIK, SHC doesn't support DB Connect inputs.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Are you SH clustered?

0 Karma

dantonag
Explorer

Yes, I think they are.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...