Knowledge Management

What do these dbx.log messages and parameter values refer to in Splunk DB Connect?

splunkIT
Splunk Employee
Splunk Employee

I have configured a DB input from the Splunk/Manager/DataInputs/Database Inputs and scheduled a simple job to select data from a table using id as the Rising column. I want this to run frequently every 5 mins and I gave cron expression (*/5 * * * * ) and added it to an existing index with a sourcetype. I looked at the dbx.log file and I see these messages:

2014-07-17 18:26:40.232 dbx8478:INFO:BridgeSession - Executing Bridge command: BridgeExecutionInfo{className=com.splunk.bridge.cmd.Reload} 
2014-07-17 18:26:40.232 dbx8478:INFO:Reload - Reloading component=dbmon 
2014-07-17 18:26:40.232 dbx8478:INFO:DatabaseMonitoringManager - Starting database inputs scheduler 
2014-07-17 18:26:40.232 dbx8478:INFO:Scheduler - Initialized scheduler with settings { initalScheduleDelay=5000 autoMinDelay=5000 autoMaxDelay=120000 autoDurationFactor=100 autoDecayIncrement=5000 } 

Question is what do these parameter values refer to:

initalScheduleDelay=5000 autoMinDelay=5000 autoMaxDelay=120000 autoDurationFactor=100 autoDecayIncrement=5000

Tags (2)
0 Karma
1 Solution

btsay_splunk
Splunk Employee
Splunk Employee

For every 5 min setting, set interval = 300, meaning 300 second.
http://docs.splunk.com/Documentation/DBX/1.1.4/DeployDBX/inputsspec

As the dbmon parameters, they are configured in the section [dbmon] of java.conf:
scheduler.startup.delay: initialScheduleDelay in java, the default is 5000 milliseconds
scheduler.auto.mix.delay: autoMinDelay in java, the default is 5000 milliseconds.
scheduler.auto.max.delay: autoMaxDelay in java, the default is 120000 milliseconds.
scheduler.auto.duration.factor: autoDurationFactor, the default is 100
scheduler.auto.decay.increment: autoDecayIncrement, the default is 5000 milliseconds.

Those parameters are used to decide how long the next scheduled monitor will occur when the monitor type is set interval = auto.

See README/inputs.conf.spec to explain the interval settings as auto, relative time and cron.

View solution in original post

btsay_splunk
Splunk Employee
Splunk Employee

For every 5 min setting, set interval = 300, meaning 300 second.
http://docs.splunk.com/Documentation/DBX/1.1.4/DeployDBX/inputsspec

As the dbmon parameters, they are configured in the section [dbmon] of java.conf:
scheduler.startup.delay: initialScheduleDelay in java, the default is 5000 milliseconds
scheduler.auto.mix.delay: autoMinDelay in java, the default is 5000 milliseconds.
scheduler.auto.max.delay: autoMaxDelay in java, the default is 120000 milliseconds.
scheduler.auto.duration.factor: autoDurationFactor, the default is 100
scheduler.auto.decay.increment: autoDecayIncrement, the default is 5000 milliseconds.

Those parameters are used to decide how long the next scheduled monitor will occur when the monitor type is set interval = auto.

See README/inputs.conf.spec to explain the interval settings as auto, relative time and cron.

splunkIT
Splunk Employee
Splunk Employee

I have also seen similar messages like the following:


2014-07-1714:04:45.935dbx760:INFO:ExecutionSchedule-Cancellingexecutionscheduleinput=[dbmon-tail://mysql_db1/testdbx]
nextExecution=5000state=RUNNING
2014-07-1714:23:42.622dbx5073:INFO:ExecutionSchedule-
Cancelling executionschedule
input=[dbmon-tail://mysql_db1/testdbx]
nextExecution=5000state=WAITING

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...