I have been using the DBConnect app for splunk for a few weeks, indexing just fine. The problem came up last week, when I noticed events were not up to date.
I checked dbx.log for errors and found the following error for all inputs:
Error:Scheduler - Error while reading
com.splunk.config.SplunkConfigurationException: No output.format defined for stanza.
This error occurs even though
output.format=kv EXISTS in the stanza in inputs.conf!
I tried restarting Splunk unsuccessfully.
When I used the CLI command:
splunk.exe cmd btool inputs list dbmon-tail://DatabaseName/InputName
the output showed me that all inputs are automatically disabled (
How can I prevent this from happenning?
Check for a conflicting inputs.conf file.
Changes to inputs.conf will be made in the app that initiated the change, so if you enter manager from launcher and make a change to a dbx input the stanza will be written to launcher/local/inputs.conf, but if you change it from db connect it will go to dbx/local/inputs.conf.
Did you restart splunk?
Having the same problem. I looked and indeed there was a stanza in the launcher/local/ directory. I deleted it and then used the DBX app to disable/enable. Still getting the same error. Checked "btool inputs list" and I don't see a conflict.