Splunk Enterprise

App DB Connect - DB Input gets disabled after connection failures although auto_disable = false

altink
Builder

Hi

The database connection gets disabled after some connection failures - done for normal periodic db maintenance - although the auto_disable has been set to "false". The later was supposed to stop the auto-disabling.

App DB Connect vrs is 2.4

the DB Input entry is shown below - (Zs used for covering some private content):

 

 

 

[mi_input://ZZZZZ]
connection = ORA_LIVE
description = zzzzz
enable_query_wrapping = 1
index = db_oracle
input_timestamp_column_fullname = (003) NULL.SYSTEM_START_TIME.DATE
input_timestamp_column_name = SYSTEM_START_TIME
interval = 60
max_rows = 10000
mode = tail
output_timestamp_format = yyyy-MM-dd HH:mm:ss
query = zzzzz
source = zzzzz
sourcetype = oracle:fcc:audit
tail_rising_column_checkpoint_value = 61393439
tail_rising_column_fullname = (001) NULL.SEQUENCE_NO.NUMBER
tail_rising_column_name = SEQUENCE_NO
ui_query_catalog = NULL
ui_query_mode = advanced
ui_query_schema = ZZZZZ
ui_query_table = ZZZZZ
auto_disable = false
disabled = 0

 

 

 



Can someone advise how to keep the DB Input enabled whatever the number of failures ?

best regards
Altin

Labels (1)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...