All Apps and Add-ons

Splunk DB Connect 2.2.0: Why are my custom indexes not showing in the Metadata Index list?

dbray_sd
Path Finder

I just updated to the latest version of Splunk and the Splunk DB Connect 2.2.0 app and noticed that when I create a new DB Input, I am unable to select my custom indexes from the list. The only ones available are: history (default), main, splunklogger, and summary. I have to edit the /opt/splunk/etc/apps/splunk_app_db_connect/local/inputs.conf and manually type in my custom index. This didn't happen on the previous versions.

alt text

0 Karma

bwheelock
Path Finder

I don't know why this change was made, and you certainly can work around it using the manual inputs change like you said, but you can also just create the same index name on the local search head to get the name to show up in the list. The data will still be sent to your indexers if everything else is configured correctly; if you are concerned you can always adjust your initial import to a smaller batch.

I use the same solution you do, but I thought I would mention the above alternative. I had to do the same thing with Stream when I set it up, and I didn't find anything in the documentation to suggest I did something wrong.

0 Karma

ppanchal
Path Finder

I am new to splunk, I am also facing the same issue.

Can you tell me how did you add the custom index at /opt/splunk/etc/apps/splunk_app_db_connect/local/inputs.conf ?

Did you just change the index name or it is something else as well?

I tried changing only the index name, it did not work for me 😞

Can you please help?

0 Karma

bwheelock
Path Finder

Yes, you should only have to change the index name in the inputs.conf file. Same thing with host. Since the change affects indexing, you will likely need to restart Splunk to apply the change. Most of the time I create the new input from the conf file directly and restart Splunk, rather than create it from the DBX app, but then I don't work with it that much.

source =
sourcetype =
index =
host =

0 Karma

ppanchal
Path Finder

You mean to say restart splunk on the server that is the indexer in my case through command line , am I correct?

0 Karma

bwheelock
Path Finder

Restart Splunk via CLI or through the web (Server Controls) on the server that contains the inputs.conf file; wherever DBX is installed. So if you only have one server, or if DBX is installed on the indexer, then yes. I think it's best practice to place collectors tools like this on another Search Head though.

0 Karma

ppanchal
Path Finder

Thank you, that worked.

One more question, If I directly configure the new input in the input.conf manually, will I still have to restart splunk for the changes to take effect? Also, will the new input be visible on the UI?

0 Karma

bwheelock
Path Finder

Yes, any change to an inputs.conf file that affect indexing typically requires a reboot of Splunk.

Yes, the new input will be visible under the DBX configuration once you've added it in.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...