Splunk Search

How DBX decides dbmon interval

melonman
Motivator

Hello,

I am using DB Connect to pull data from my DB.
I had configured dbmon interval manually (interval = 30s, for example).
However, DBX can adjust interval automatically. (interval = auto)

My question is, how DBX is deciding and adjusting the interval for dbmon.

Could anyone comment and hopefully provide information in detail?

Thank you!

0 Karma

phoenixdigital
Builder

Super late response but I thought I would post the answer as I was looking for the exact same information.

The only answer I could find was

auto - The scheduler automatically chooses an interval based on the number of generated results.

Ref: http://docs.splunk.com/Documentation/DBX/1.2.0/DeployDBX/inputsspec

I had a dig through the DatamaseMonitor.class in the dbx.jar which lead me to Scheduler.class which led me to this function which determines the time

    private long getAutoDelay(DbmonResult result) {
        if (result.getResultCount() == 0) {
            long lastDelay = result.getMonitorDefintion().getLastDelay();
            if (lastDelay != -1) {
                return Math.max(this.autoMinDelay, Math.min(lastDelay + this.autoDecayIncrement, this.autoMaxDelay));
            }
            return this.autoMaxDelay;
        }
        return Math.min(Math.max(this.autoMinDelay, result.getDuration() / (long)result.getResultCount() * (long)this.autoDurationFactor), this.autoMaxDelay);
    }

this.autoMinDelay defaults to 5000
this.autoMaxDelay defaults to 5000
this.autoDecayIncrement defaults to 5000
this.autoDurationFactor defaults to 100

So it appears to be related to the number of factors such as

  • Number of results returned
  • How long the last delay was between queries
  • How long the search took to run

So for a search that returned zero results the delay appears to be every 5000ms
For a search with more than zero results it is based on this function

return Math.min(Math.max(this.autoMinDelay, result.getDuration() / (long)result.getResultCount() * (long)this.autoDurationFactor), this.autoMaxDelay);

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Synthetic Monitoring - Resolved Incident on Detector Alerts

We’ve discovered a bug that affected the auto-clear of Synthetic Detectors in the Splunk Synthetic Monitoring ...

Video | Tom’s Smartness Journey Continues

Remember Splunk Community member Tom Kopchak? If you caught the first episode of our Smartness interview ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud? Learn how unique features like ...