I know you can search for list of all db connect jobs and when they've ran historically within the internal logs, which gets you how long the query ran, # events and error count. Is there anyway to get which index, source and sourcetype it was written to without having to check on the DB Connection inputs ? For example, I'd like to know where it was written and if anything has changed since it ran?
index=_internal sourcetype=dbx* status=* input_name
I'm guessing the answer is no. I've taken this with a different approach - using the DB Connect rest api. If anyone knows of a better way for this, please post. Greatly appreciated.
| rest splunk_server=localhost /servicesNS/nobody/splunk_app_db_connect/properties/db_inputs/
| table title, updated
| rename title as dbinput_name
| join type=left dbinput_name
[| rest splunk_server=localhost /servicesNS/nobody/splunk_app_db_connect/properties/db_inputs/
| fields title
| map search="| rest splunk_server=localhost /servicesNS/nobody/splunk_app_db_connect/properties/db_inputs/$title$/index|eval dbinput_name = \"$title$\", index=value|table dbinput_name index" maxsearches=400]
| join type=left dbinput_name
[| rest splunk_server=va10dlvspl301 /servicesNS/nobody/splunk_app_db_connect/properties/db_inputs/
| fields title
| map search="| rest splunk_server=va10dlvspl301 /servicesNS/nobody/splunk_app_db_connect/properties/db_inputs/$title$/sourcetype|eval dbinput_name = \"$title$\", sourcetype=value|table dbinput_name sourcetype" maxsearches=400]