It appears that if someone goes into the dbconnect app and goes through the process to “Save” the ip360_scan_status input, then the dbconnect adds new parameters to our inputs.conf that creates this problem.
So an example inputs.conf with the "extra" lines from the save would be like this:
[root@localhost apps]# diff splunk_app_db_connect/local/inputs.conf splunk_app_db_connect/local/inputs.conf.bak
83,86d82
< enable_query_wrapping = 1
< tail_rising_column_fullname = (003) nc_audit.end_date.timestamptz
< tail_rising_column_checkpoint_value = 2017-10-06 15:40:46.213108-04
< disabled = 0
To fix the error:
1. Delete the enable_query_wrapping, tail_rising_column_fullname, and tail_rising_column_checkpoint_value lines from the input.conf
2. Disable/re-enable the ip360_scan_status input
3. This should start working again.
WARNING: Make sure you do not go back through the input in the dbconnect app and click Save again! If you do, those parameters are added to the input.conf and the app is broken again.
... View more
