Getting Data In

dbmon-dump not indexing my records

linu1988
Champion

Hello All,
i am struggling with my db-dump input in loading data from db query to index. I have defined the db input using dbx 1.1.3 app and it executes fine with the defined time. I could see the records being read in the dbx.log file but they don't get indexed. Could anyone guide me with this? why it is behaving like this and where exactly all those records are going? Please let me know if more info is required.

I keep getting this success messages but no indexed records 😞
2014-05-03 12:02:00.049 monsch1:INFO:Scheduler - Execution of input=[dbmon-dump://Test/dump2] finished in duration=48 ms with resultCount=183 success=true continueMonitoring=true
Thank you in advance.

0 Karma
1 Solution

linu1988
Champion

Oh Okay, after such a long struggle figured out where the problem was. Even if it's not connected with the actual input the below actually batch processes all the monitored events. Don't know why it was actually missing in the first place. Linux and windows has it's own directory path format. Mine is windows and after making it proper it's now monitoring all the events even the pending ones. Hope it really gives starting point for some people.

[batch://$SPLUNK_HOME\var\spool\dbmon\*.dbmonevt]
crcSalt = <SOURCE>
disabled = 0
move_policy = sinkhole
sourcetype = dbmon:spool

I am using SQL Server where it recognizes the time fields and assigns them in the events in the index directly. So no need to convert them to varchar or char format. Happy for my Sunday now 😄

View solution in original post

0 Karma

linu1988
Champion

Oh Okay, after such a long struggle figured out where the problem was. Even if it's not connected with the actual input the below actually batch processes all the monitored events. Don't know why it was actually missing in the first place. Linux and windows has it's own directory path format. Mine is windows and after making it proper it's now monitoring all the events even the pending ones. Hope it really gives starting point for some people.

[batch://$SPLUNK_HOME\var\spool\dbmon\*.dbmonevt]
crcSalt = <SOURCE>
disabled = 0
move_policy = sinkhole
sourcetype = dbmon:spool

I am using SQL Server where it recognizes the time fields and assigns them in the events in the index directly. So no need to convert them to varchar or char format. Happy for my Sunday now 😄

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...