saving db connect tmp files

[a212830]

Hi

I need to save the db connect tmp files for debugging purposes. Is there a way to tell db connect to save them?

[ziegfried · Accepted solution]

DB Connect creates a batch input for moving data to Splunk. The batch input is defined in $SPLUNK_HOME/etc/apps/dbx/local/inputs.conf

[batch://$SPLUNK_HOME/var/spool/dbmon/*.dbmonevt]
crcSalt = <SOURCE>
disabled = 0
move_policy = sinkhole
sourcetype = dbmon:spool

You can simply disable this input, then it won't be deleted (and indexed). To continue to index the data and still preserve the files, you could turn it into a regular file monitor:

[monitor://$SPLUNK_HOME/var/spool/dbmon/*.dbmonevt]
crcSalt = <SOURCE>
disabled = 0
sourcetype = dbmon:spool

[a212830]

Good stuff! Thanks.