Hi,
In DB connect app for one of the connections we are able to see the sql output in the app but it has stopped indexing. We can see the connection name in dbx_audit log but no errors.
11/15/18
12:56:13.938 PM
2018-11-15 12:56:13.938 25125@psplunksh03 [main] INFO com.splunk.dbx.connector.logger.AuditLogger - operation=dbxquery connection_name=OBJPROD stanza_name= state=success sql='select ACTIVE_USERS, LICENSE_COUNT from (select count() as Active_Users from users where DATE_INACTIVATE is null and DATE_DISABLE is null) cross join LICENSED_USERS'
host = source = /opt/splunk/var/log/splunk/splunk_app_db_connect_audit_command.2018-11-15.log sourcetype = dbx_audit
11/15/18
12:49:11.195 PM
2018-11-15 12:49:11.195 54724@psplunksh03 [main] INFO com.splunk.dbx.connector.logger.AuditLogger - operation=dbxquery connection_name=OBJPROD stanza_name= state=success sql='select ACTIVE_USERS, LICENSE_COUNT from (select count() as Active_Users from users where DATE_INACTIVATE is null and DATE_DISABLE is null) cross join LICENSED_USERS'
host = source = /opt/splunk/var/log/splunk/splunk_app_db_connect_audit_command.2018-11-15.log sourcetype = dbx_audit
11/15/18
12:41:00.687 PM
2018-11-15 12:41:00.687 17855@psplunksh03 [main] INFO com.splunk.dbx.connector.logger.AuditLogger - operation=dbxquery connection_name=OBJPROD stanza_name= state=success sql='select ACTIVE_USERS, LICENSE_COUNT from (select count() as Active_Users from users where DATE_INACTIVATE is null and DATE_DISABLE is null) cross join LICENSED_USERS'
host = source = /opt/splunk/var/log/splunk/splunk_app_db_connect_audit_command.2018-11-15.log sourcetype = dbx_audit
11/15/18
12:34:05.424 PM
2018-11-15 12:34:05.424 47505@psplunksh03 [main] INFO com.splunk.dbx.connector.logger.AuditLogger - operation=dbxquery connection_name=OBJPROD stanza_name= state=success sql='select ACTIVE_USERS, LICENSE_COUNT from (select count() as Active_Users from users where DATE_INACTIVATE is null and DATE_DISABLE is null) cross join LICENSED_USERS'
host = source = /opt/splunk/var/log/splunk/splunk_app_db_connect_audit_command.2018-11-15.log sourcetype = dbx_audit
11/15/18
12:20:21.338 PM
2018-11-15 12:20:21.338 46563@psplunksh03 [main] INFO com.splunk.dbx.connector.logger.AuditLogger - operation=dbxquery connection_name=OBJPROD stanza_name= state=success sql='select ACTIVE_USERS, LICENSE_COUNT from (select count() as Active_Users from users where DATE_INACTIVATE is null and DATE_DISABLE is null) cross join LICENSED_USERS'
host = source = /opt/splunk/var/log/splunk/splunk_app_db_connect_audit_command.2018-11-15.log sourcetype = dbx_audit
11/15/18
12:15:07.969 PM
2018-11-15 12:15:07.969 22282@psplunksh03 [main] INFO com.splunk.dbx.connector.logger.AuditLogger - operation=dbxquery connection_name=OBJPROD stanza_name= state=success sql='select ACTIVE_USERS, LICENSE_COUNT from (select count() as Active_Users from users where DATE_INACTIVATE is null and DATE_DISABLE is null) cross join LICENSED_USERS'
host = source = /opt/splunk/var/log/splunk/splunk_app_db_connect_audit_command.2018-11-15.log sourcetype = dbx_audit
... View more
