Splunk Enterprise

App DB Connect - DB Input gets disabled after connection failures although auto_disable = false

altink
Builder

Hi

The database connection gets disabled after some connection failures - done for normal periodic db maintenance - although the auto_disable has been set to "false". The later was supposed to stop the auto-disabling.

App DB Connect vrs is 2.4

the DB Input entry is shown below - (Zs used for covering some private content):

 

 

 

[mi_input://ZZZZZ]
connection = ORA_LIVE
description = zzzzz
enable_query_wrapping = 1
index = db_oracle
input_timestamp_column_fullname = (003) NULL.SYSTEM_START_TIME.DATE
input_timestamp_column_name = SYSTEM_START_TIME
interval = 60
max_rows = 10000
mode = tail
output_timestamp_format = yyyy-MM-dd HH:mm:ss
query = zzzzz
source = zzzzz
sourcetype = oracle:fcc:audit
tail_rising_column_checkpoint_value = 61393439
tail_rising_column_fullname = (001) NULL.SEQUENCE_NO.NUMBER
tail_rising_column_name = SEQUENCE_NO
ui_query_catalog = NULL
ui_query_mode = advanced
ui_query_schema = ZZZZZ
ui_query_table = ZZZZZ
auto_disable = false
disabled = 0

 

 

 



Can someone advise how to keep the DB Input enabled whatever the number of failures ?

best regards
Altin

Labels (1)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...