All Apps and Add-ons

If I disable, then reenable an input for the Splunk Add-on for ServiceNow, why is data loaded from the beginning instead of the last checkpoint date?

wegscd
Contributor

I'm doing some testing on the Splunk Add-on for ServiceNow (and the Splunk App for ServiceNow).

I noticed that if I disable an input, then reenable it (without touching the checkpoint files), the TA will act like it had never been run before and extracting data for the newly enabled table from the beginning, instead of from the last checkpointed date.

Is this the design behaviour?

0 Karma

cesaccenturefed
Path Finder

The snow_config.py has an error check for the checkpoint file and when you disable the input and you run it again it look for conflicts and if it sees an existing file it cleans it and creates a new one.

WARNING pid=3297 tid=MainThread file=snow_config.py:remove_checkpoint:423 | Clean checkpoint file: /$splunkhome$/splunk/var/lib/splunk/modinputs/snow/cmn_location.sys_updated_on

your best bet is to grab the date in the check point file and add it as the since_when= date on the inputs.conf when you go to turn disable the input. then when you back to turn it on its already has the right date to look back to.

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

That sounds like a bug... Have you set the date started from parameter? http://docs.splunk.com/Documentation/AddOns/latest/ServiceNow/Configureinputs

0 Karma

wegscd
Contributor

If I do it works correctly. That means that the workaround is that if I decide to disable an input, I need to figure out what the proper date is to start picking up data again.

I think I would classify that as a bug. I can see if starting over from the beginning if I remove an input, but not if I disable it.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...