Knowledge Management

What do these dbx.log messages and parameter values refer to in Splunk DB Connect?

splunkIT
Splunk Employee
Splunk Employee

I have configured a DB input from the Splunk/Manager/DataInputs/Database Inputs and scheduled a simple job to select data from a table using id as the Rising column. I want this to run frequently every 5 mins and I gave cron expression (*/5 * * * * ) and added it to an existing index with a sourcetype. I looked at the dbx.log file and I see these messages:

2014-07-17 18:26:40.232 dbx8478:INFO:BridgeSession - Executing Bridge command: BridgeExecutionInfo{className=com.splunk.bridge.cmd.Reload} 
2014-07-17 18:26:40.232 dbx8478:INFO:Reload - Reloading component=dbmon 
2014-07-17 18:26:40.232 dbx8478:INFO:DatabaseMonitoringManager - Starting database inputs scheduler 
2014-07-17 18:26:40.232 dbx8478:INFO:Scheduler - Initialized scheduler with settings { initalScheduleDelay=5000 autoMinDelay=5000 autoMaxDelay=120000 autoDurationFactor=100 autoDecayIncrement=5000 } 

Question is what do these parameter values refer to:

initalScheduleDelay=5000 autoMinDelay=5000 autoMaxDelay=120000 autoDurationFactor=100 autoDecayIncrement=5000

Tags (2)
0 Karma
1 Solution

btsay_splunk
Splunk Employee
Splunk Employee

For every 5 min setting, set interval = 300, meaning 300 second.
http://docs.splunk.com/Documentation/DBX/1.1.4/DeployDBX/inputsspec

As the dbmon parameters, they are configured in the section [dbmon] of java.conf:
scheduler.startup.delay: initialScheduleDelay in java, the default is 5000 milliseconds
scheduler.auto.mix.delay: autoMinDelay in java, the default is 5000 milliseconds.
scheduler.auto.max.delay: autoMaxDelay in java, the default is 120000 milliseconds.
scheduler.auto.duration.factor: autoDurationFactor, the default is 100
scheduler.auto.decay.increment: autoDecayIncrement, the default is 5000 milliseconds.

Those parameters are used to decide how long the next scheduled monitor will occur when the monitor type is set interval = auto.

See README/inputs.conf.spec to explain the interval settings as auto, relative time and cron.

View solution in original post

btsay_splunk
Splunk Employee
Splunk Employee

For every 5 min setting, set interval = 300, meaning 300 second.
http://docs.splunk.com/Documentation/DBX/1.1.4/DeployDBX/inputsspec

As the dbmon parameters, they are configured in the section [dbmon] of java.conf:
scheduler.startup.delay: initialScheduleDelay in java, the default is 5000 milliseconds
scheduler.auto.mix.delay: autoMinDelay in java, the default is 5000 milliseconds.
scheduler.auto.max.delay: autoMaxDelay in java, the default is 120000 milliseconds.
scheduler.auto.duration.factor: autoDurationFactor, the default is 100
scheduler.auto.decay.increment: autoDecayIncrement, the default is 5000 milliseconds.

Those parameters are used to decide how long the next scheduled monitor will occur when the monitor type is set interval = auto.

See README/inputs.conf.spec to explain the interval settings as auto, relative time and cron.

splunkIT
Splunk Employee
Splunk Employee

I have also seen similar messages like the following:


2014-07-1714:04:45.935dbx760:INFO:ExecutionSchedule-Cancellingexecutionscheduleinput=[dbmon-tail://mysql_db1/testdbx]
nextExecution=5000state=RUNNING
2014-07-1714:23:42.622dbx5073:INFO:ExecutionSchedule-
Cancelling executionschedule
input=[dbmon-tail://mysql_db1/testdbx]
nextExecution=5000state=WAITING

0 Karma
Get Updates on the Splunk Community!

Almost Too Eventful Assurance: Part 1

Modern IT and Network teams still struggle with too many alerts and isolating issues before they are notified. ...

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...