Splunk Enterprise

App DB Connect - DB Input gets disabled after connection failures although auto_disable = false

altink
Builder

Hi

The database connection gets disabled after some connection failures - done for normal periodic db maintenance - although the auto_disable has been set to "false". The later was supposed to stop the auto-disabling.

App DB Connect vrs is 2.4

the DB Input entry is shown below - (Zs used for covering some private content):

 

 

 

[mi_input://ZZZZZ]
connection = ORA_LIVE
description = zzzzz
enable_query_wrapping = 1
index = db_oracle
input_timestamp_column_fullname = (003) NULL.SYSTEM_START_TIME.DATE
input_timestamp_column_name = SYSTEM_START_TIME
interval = 60
max_rows = 10000
mode = tail
output_timestamp_format = yyyy-MM-dd HH:mm:ss
query = zzzzz
source = zzzzz
sourcetype = oracle:fcc:audit
tail_rising_column_checkpoint_value = 61393439
tail_rising_column_fullname = (001) NULL.SEQUENCE_NO.NUMBER
tail_rising_column_name = SEQUENCE_NO
ui_query_catalog = NULL
ui_query_mode = advanced
ui_query_schema = ZZZZZ
ui_query_table = ZZZZZ
auto_disable = false
disabled = 0

 

 

 



Can someone advise how to keep the DB Input enabled whatever the number of failures ?

best regards
Altin

Labels (1)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...