Splunk Enterprise

App DB Connect - DB Input gets disabled after connection failures although auto_disable = false



The database connection gets disabled after some connection failures - done for normal periodic db maintenance - although the auto_disable has been set to "false". The later was supposed to stop the auto-disabling.

App DB Connect vrs is 2.4

the DB Input entry is shown below - (Zs used for covering some private content):




connection = ORA_LIVE
description = zzzzz
enable_query_wrapping = 1
index = db_oracle
input_timestamp_column_fullname = (003) NULL.SYSTEM_START_TIME.DATE
input_timestamp_column_name = SYSTEM_START_TIME
interval = 60
max_rows = 10000
mode = tail
output_timestamp_format = yyyy-MM-dd HH:mm:ss
query = zzzzz
source = zzzzz
sourcetype = oracle:fcc:audit
tail_rising_column_checkpoint_value = 61393439
tail_rising_column_fullname = (001) NULL.SEQUENCE_NO.NUMBER
tail_rising_column_name = SEQUENCE_NO
ui_query_catalog = NULL
ui_query_mode = advanced
ui_query_schema = ZZZZZ
ui_query_table = ZZZZZ
auto_disable = false
disabled = 0




Can someone advise how to keep the DB Input enabled whatever the number of failures ?

best regards

Labels (1)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...