Archive

Splunk DB Connect: Why am I unable to index data from a Postgres database?

kbarker302
Communicator

I am trying to index data from a Postgres database using DB Connect 1. I am able to make a connection to the database, and I can also run queries and see the data by clicking on the DB Query button under "Explore database schema" in the DB Connect 1 app. However, the data is not getting indexed when I create a database input.

I know that Splunk is able to retrieve the data, because it creates a kv_nnn.dbmonevt file under C:\Program Files\Splunk\var\spool\dbmon containing the data in key/value pairs, but this data never gets indexed. To rule out any issue with the data, I also tried specifying a query that returns just one column from my database table (the primary key) but this does not get indexed despite the kv_nnn.dbmonevt file being created.

Any help would be appreciated.

0 Karma
1 Solution

s2_splunk
Splunk Employee
Splunk Employee

The problem was resolved by setting disabled=0 in inputs.conf for the database input.

View solution in original post

s2_splunk
Splunk Employee
Splunk Employee

The problem was resolved by setting disabled=0 in inputs.conf for the database input.

View solution in original post

s2_splunk
Splunk Employee
Splunk Employee

Can you share your inputs.conf file?

0 Karma

kbarker302
Communicator

Thank you - I believe you pointed me in the right direction. This is from my inputs.conf under etc\apps\dbx\local:

[batch://$SPLUNK_HOME\var\spool\dbmon*.dbmonevt]
crcSalt =
disabled = 1
move_policy = sinkhole
sourcetype = dbmon:spool

I'm not sure how or when the disabled flag got set, but I changed it to 0 and now I'm able to index the data.

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Yup, that would do it. Also note that since you didn't specify an index, your events will go to the default index (main). You may want to think about how to use multiple indexes, if you have different data retention or access permissions requirements for various data sources.

I will add the resolution as an answer, please accept it, so the question shows as 'answered'.

Happy Splunking!

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!