Getting Data In

Splunk DB Connect 3.6.0 and MySQL- having trouble with inputs

martinborjesson
Explorer

Hi! Im running Splunk DB Connect 3.6.0 on my HF (ver 8.0.9) and having some issues with one of my inputs. Im trying to index licens usage data from Appdynamics into Splunk with the query below. It runs fine in GUI and i can see the results and i dont get any errors completing the input guide. Checked the splunk_app_db_connect_audit_command.log for errors, but it logs "state=success" However, splunk_app_db_connect_job_metrics.log says "read_count=0 write_count=0 error_count=0" this is the only input against mysql. Any ideas?

 

 

 

 

SELECT usage_host.account_id AS AccountID,
         usage_host.host_id AS UniqueHostID,
         usage_host.is_fallback_host AS FallbackHost,
         usage_host.virtual_cpus AS vCPUcount,
         host_leased_units.usageUnits AS AccountHostLeasedUnits,
         if(usage_host.is_fallback_host,
         usage_lease.account_units,
         0) AS AccountLicenseEntityLeasedUnits,
         conf_package.id AS AccountLicensePackage,
         usage_license_entity.agent_type AS AgentType,
         from_unixtime(usage_license_entity.register_date) AS LeaseDate,
         usage_allocation_package.allocation_name AS LicenseRule,
         from_unixtime((floor(unix_timestamp() / 300) * 300)) AS SnapshotValidAt
FROM usage_lease
JOIN usage_host
    ON usage_host.id = usage_lease.usage_host_id
JOIN usage_allocation_package
    ON usage_allocation_package.id = usage_lease.usage_allocation_package_id
JOIN usage_license_entity
    ON usage_license_entity.id = usage_lease.usage_license_entity_id
JOIN conf_package
    ON conf_package.int_id = usage_lease.usage_package_id
JOIN 
    (SELECT usage_host.host_id,
         round(sum(usage_lease.account_units)) AS usageUnits
    FROM usage_lease
    JOIN usage_host
        ON usage_host.id = usage_lease.usage_host_id
    WHERE usage_lease.created_date = (floor(unix_timestamp() / 300) * 300)
            AND usage_host.account_id = 2
    GROUP BY  usage_host.host_id) AS host_leased_units
    ON host_leased_units.host_id = usage_host.host_id
WHERE (usage_lease.created_date = (floor(unix_timestamp() / 300) * 300)
        AND usage_host.account_id = usage_allocation_package.account_id
        AND usage_allocation_package.account_id = usage_license_entity.account_id
        AND usage_license_entity.account_id = 2)
ORDER BY  usage_host.host_id; 

 

 

 

 

Labels (2)
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Continue Your Federation Journey: Join Session 3 of the Bootcamp Series

To help practitioners build a stronger foundation, we launched the Data Management & Federation ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Casting Call: Compete in Cyber Games

Lights, Camera, SecOps: Apply to Compete in Cyber Games     Think you have what it takes to beat the clock? ...