Splunk Search

DB Connect - dbmon-dump and dbmon-tail do not produce results

terryloar
Path Finder

In DB Connect I used "Data Inputs in Splunk Manager" to create test_dump which it did without error and produced:

dbmon-dump://TitalMaster106s/test_dump_2

The query in the dump is:

select * from jobrun

The DB is valid and jobrun_id is a valid field in the table jobrun in the DB TitalMaster106s.

I ran this search:

dbmon-dump://TitalMaster106s/test_dump_2 | table jobrun_id

No errors are thrown but it produces no results:

No results found. Inspect ...

local/input.conf table looks like this:

[dbmon-dump://TitalMaster106s/test_dump_2]
output.format = kv
output.timestamp = 0
host = wsql116s
index = default
interval = auto
table = test_dump_2
query = select * from jobrun

It does the same thing for dbmon-tail...

$SPLUNK_HOME/var/spool does not have a dbmon directory

0 Karma

k_ankit
New Member

Since your Index is default, I think that you have not provided any value in the index field while creating the database input. However, it should not create a problem while running the query, I suggest you should use source while running the query.
Try this:
source="dbmon-dump://TitalMaster106s/test_dump_2" | table jobrun_id
Whenever a database input is created it is stored as a source in splunk.

0 Karma

lukejadamec
Super Champion

Are you still working on this? I can probably help if you are.

0 Karma

stscholz
New Member

Think your search is wrong:
Please check this first:
index=* source="dbmon-dump://TitalMaster106s/test_dump_2"

Also change the setting from the Intervall to e.g. 5m
Have a look to the dbx log at ../var/log/splunk/dbx.log for any messages.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...