Hi guys
Recently we updated the DB Connect App from 2.2.4 to 3.1.0.
In the old version we used to alert disabled inputs via REST with this search:
|rest splunk_server=local /servicesNS/-/-/configs/inputs
|rename eai:acl.app as app
|search app="splunk_app_db_connect" title="mi_input://*"
|table title,connection,disabled,updated
|where disabled=1
Unfortunately it no longer works. The query
|rest splunk_server=local /servicesNS/-/-/configs/inputs |rename eai:acl.app as app | search app="splunk_app_db_connect"
returns only 2 lines, but I expect it to return our ~70 input definitions.
Does anyone know of another query?
Thanks in advance and kind regards
- Muryoutaisuu
I believe that you are looking for the following:
| rest splunk_server=local /servicesNS/-/-/configs/conf-db_inputs/
I had been searching for this as well and found a post about DB Connect connections that got me thinking in the right direction to figure this out.
I believe that you are looking for the following:
| rest splunk_server=local /servicesNS/-/-/configs/conf-db_inputs/
I had been searching for this as well and found a post about DB Connect connections that got me thinking in the right direction to figure this out.
Yes, that was absolutetly what I was searching for.
In the meantime I contacted the support and it's no longer necessary, to monitor for automatically disabled inputs, as they won't be automatically disabled anymore.