All Apps and Add-ons

Splunk DB Connect 2.3.0: How to automatically re-enable DBX operations after restarting the app?

bsherwoodofdapt
Explorer

I am running version 2.3.0 and have a problem I would like to work around.
When one of my DB servers gets taken offline for maintenance, and there is a Splunk DB Connect operation that would access it, and that operation gets set to Disabled at some point. That makes sense.

Due to some quirk / defect, my Heavy Forwarder where DB Connect is running will stop running DB Connect all together. So I have added a nightly Splunk restart task, and that keeps it healthy enough for my needs right now.

That said, if I have disabled operations, I would like then to be re-enabled on a restart of DB Connect. Is that even possible? Or will manual intervention be required every time?

0 Karma
1 Solution

ktugwell_splunk
Splunk Employee
Splunk Employee

Hey there,

DB Connect automatically disables inputs when the connection cannot be made to the database after 6 retries.

Have you thought about disabling that functionality, so they will not auto disable?

In your inputs.conf

 [my_input]
 ...
 auto_disable = false

http://docs.splunk.com/Documentation/DBX/2.4.0/DeployDBX/inputsspec

I think this should work for you.

Thanks

View solution in original post

bsherwoodofdapt
Explorer

I would suspect 'no'. It is a configuration file change and it only impacts DBConnect. So you would need a DB Connect task of some sort that can parse its own inputs file and determine which type of input doesn't have the desired key.

I have no idea if you can write a DBConnect task that probes the running state of DBConnect.

0 Karma

ktugwell_splunk
Splunk Employee
Splunk Employee

Hey there,

DB Connect automatically disables inputs when the connection cannot be made to the database after 6 retries.

Have you thought about disabling that functionality, so they will not auto disable?

In your inputs.conf

 [my_input]
 ...
 auto_disable = false

http://docs.splunk.com/Documentation/DBX/2.4.0/DeployDBX/inputsspec

I think this should work for you.

Thanks

bsherwoodofdapt
Explorer

Outstanding. Thank you.

Interestingly buried quite deep in the example config file.

0 Karma

sbattista09
Contributor

Is there a was to set up a alert that will tell you have input was auto disabled? I would like set one up to ensure we do not drop a connection if someone forgets to set auto_disable = false.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...