Why after the upgrade of Splunk DB connect (2.3.1 -> 3.1.1), we can't delete inputs?

[eduardocrb]

After upgrade Splunk DB connect (2.3.1 -> 3.1.1) we can't delete inputs. When we try, the following message is displayed: Splunkd error: HTTP 404 -- User does not exist. splunk_app_db_connect.

Any tips? Regards.

[harsmarvania57]

Hi @eduardocrb,

There is workaround for this problem.

1. Go to $SPLUNK_HOME/etc/apps/splunk_app_db_connect/metadata/

2. Check local.meta file and search entries starting with [db_inputs/<DB INPUT NAME>], here you need to add owner = <OWNER NAME>
   So after modification each db_inputs entry will look something like

   [db_inputs/<DB INPUT NAME>]
   access = read : [ admin, db_connect_admin, db_connect_user ], write : [ admin, db_connect_admin ]
   export = none
   owner = <OWNER NAME>
   version = 6.4.5
   modtime = 1504709637.167172000
   

3. Restart splunk service and now try to delete inputs from SplunkWeb.

I hope this helps.

Thanks,
Harshil