Getting Data In

dbmon-dump not indexing my records

linu1988
Champion

Hello All,
i am struggling with my db-dump input in loading data from db query to index. I have defined the db input using dbx 1.1.3 app and it executes fine with the defined time. I could see the records being read in the dbx.log file but they don't get indexed. Could anyone guide me with this? why it is behaving like this and where exactly all those records are going? Please let me know if more info is required.

I keep getting this success messages but no indexed records 😞
2014-05-03 12:02:00.049 monsch1:INFO:Scheduler - Execution of input=[dbmon-dump://Test/dump2] finished in duration=48 ms with resultCount=183 success=true continueMonitoring=true
Thank you in advance.

0 Karma
1 Solution

linu1988
Champion

Oh Okay, after such a long struggle figured out where the problem was. Even if it's not connected with the actual input the below actually batch processes all the monitored events. Don't know why it was actually missing in the first place. Linux and windows has it's own directory path format. Mine is windows and after making it proper it's now monitoring all the events even the pending ones. Hope it really gives starting point for some people.

[batch://$SPLUNK_HOME\var\spool\dbmon\*.dbmonevt]
crcSalt = <SOURCE>
disabled = 0
move_policy = sinkhole
sourcetype = dbmon:spool

I am using SQL Server where it recognizes the time fields and assigns them in the events in the index directly. So no need to convert them to varchar or char format. Happy for my Sunday now 😄

View solution in original post

0 Karma

linu1988
Champion

Oh Okay, after such a long struggle figured out where the problem was. Even if it's not connected with the actual input the below actually batch processes all the monitored events. Don't know why it was actually missing in the first place. Linux and windows has it's own directory path format. Mine is windows and after making it proper it's now monitoring all the events even the pending ones. Hope it really gives starting point for some people.

[batch://$SPLUNK_HOME\var\spool\dbmon\*.dbmonevt]
crcSalt = <SOURCE>
disabled = 0
move_policy = sinkhole
sourcetype = dbmon:spool

I am using SQL Server where it recognizes the time fields and assigns them in the events in the index directly. So no need to convert them to varchar or char format. Happy for my Sunday now 😄

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...