Getting Data In

Splunk not indexing data after configuring Splunk DB Connect app

spoorthyredi
New Member

All,

We configured splunk to index data from a Oracle DataBase using Splunk DB Connect App .
Our database tables and data are very simple , and we are using free version of splunk .

Below are our observations :
Data Base Input configuration :

[InputType : Tail **

Rising Column : number type

Sourcetype : dbmon:kv

Splunk Index : default

Output format : Key-Value ]

  1. When index interval was set to AUTO , splunk indexed the data (very few new rows )at a random speed . i.e, after few hours or sometimes even after a day .

  2. When index interval is set to 60 sec - First , 10 new rows were indexed in 30 minutes .Then , for once , data (with 50 new rows ) was indexed exactly in 60 sec . After adding 150-200 new rows , indexing din't happen at all .

  3. Now we set the interval to 2 sec and inserted just 3 new rows . No indexing happened .

We suspect it is because of the load on splunk server . Could anyone please tell whats the problem here .
Appreciate any advise on how to make splunk index database data quickly .

Please help !!

0 Karma

okrabbe_splunk
Splunk Employee
Splunk Employee

Have you had a chance to look at the splunkd logs? You will see errors with dbconnect there. You can search them by search "index=_internal splunkd"

0 Karma

sroback_splunk
Splunk Employee
Splunk Employee

Hi. DB Connect is not supported on the free version of Splunk. See http://docs.splunk.com/Documentation/DBX/1.1.4/DeployDBX/Deploymentrequirements#Supported_Splunk_ver...

You might want to upgrade to a licensed version of Splunk Enterprise or contact Splunk support (suppport@splunk.com) to evaluate your options.

okrabbe_splunk
Splunk Employee
Splunk Employee

They are probalby using an enterprise trial to evaluate the product.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...