Splunk DB Connect: Why am I unable to index data from a Postgres database?

[kbarker302]

I am trying to index data from a Postgres database using DB Connect 1. I am able to make a connection to the database, and I can also run queries and see the data by clicking on the DB Query button under "Explore database schema" in the DB Connect 1 app. However, the data is not getting indexed when I create a database input.

I know that Splunk is able to retrieve the data, because it creates a kv_nnn.dbmonevt file under C:\Program Files\Splunk\var\spool\dbmon containing the data in key/value pairs, but this data never gets indexed. To rule out any issue with the data, I also tried specifying a query that returns just one column from my database table (the primary key) but this does not get indexed despite the kv_nnn.dbmonevt file being created.

Any help would be appreciated.

[s2_splunk · Accepted solution]

The problem was resolved by setting disabled=0 in inputs.conf for the database input.

[s2_splunk]

Can you share your inputs.conf file?

[kbarker302]

Thank you - I believe you pointed me in the right direction. This is from my inputs.conf under etc\apps\dbx\local:

[batch://$SPLUNK_HOME\var\spool\dbmon*.dbmonevt]
crcSalt =
disabled = 1
move_policy = sinkhole
sourcetype = dbmon:spool

I'm not sure how or when the disabled flag got set, but I changed it to 0 and now I'm able to index the data.

[s2_splunk]

Yup, that would do it. Also note that since you didn't specify an index, your events will go to the default index (main). You may want to think about how to use multiple indexes, if you have different data retention or access permissions requirements for various data sources.

I will add the resolution as an answer, please accept it, so the question shows as 'answered'.

Happy Splunking!