I have a Splunk Enterprise Heavy Forwarder which is forwarding SQL Audit Logs by way of the Splunk DB Connect App.
my version of Splunk DB Connect is 3.2.0
(I know this is not the latest version but I am using version 3.2.0 because as soon as we upgrade to 3.4.0 DB Connect breaks completely and won't display anything it the UI).
I am having an issue where I am unable to delete an input which is a clone of another input and not required any more.
the input I want to delete is disabled but the issue happens whether the input is in an enabled or a disabled state.
to delete the input I login to my heavy forwarders Splunk Web Interface
next I select the Splunk DB Connect App from the Apps List on the left
next I select the Data Lab TAB
next I select the inputs option then I click the delete option next to the input I want to delete
I am prompted with the "Are you sure to delete this input?" message and I select OK
at that point I get an error message at the top of the page with the following message:
Splunkd error: HTTP 404 -- Action forbidden.
my input remains and I am unable to delete it.
I am an admin and I am also a DB Connect Admin so I have permissions to do whatever I want on this box.
I have looked through the splunk_app_db_connect folder in the hope of finding the .conf file where the inputs configurations are stored so that I could manually remove them there. unfortunately I am unable to figure out where these Data Lab -> Inputs are being stored
I am hoping that someone on here has a deeper understanding of DB Connect and can help me figure out how I can delete my old inputs from DB Connect either by finding the cause of the error and resolving it so it can be done via the GUI or by helping me with finding a way to delete the inputs manually via the file system for the app.
Confirm in the GUI Console that the Inputs are no longer there
NOTE: the file above is how I resolved the issue in my environment but just in case the databases are not listed in that file the file below is another location where the DB Connect App Databases are shown so potentially they could be removed there as well.