All Apps and Add-ons

Why after the upgrade of Splunk DB connect (2.3.1 -> 3.1.1), we can't delete inputs?

eduardocrb
Engager

After upgrade Splunk DB connect (2.3.1 -> 3.1.1) we can't delete inputs. When we try, the following message is displayed: Splunkd error: HTTP 404 -- User does not exist. splunk_app_db_connect.

Any tips? Regards.

Labels (1)

harsmarvania57
SplunkTrust
SplunkTrust

Hi @eduardocrb,

There is workaround for this problem.

  1. Go to $SPLUNK_HOME/etc/apps/splunk_app_db_connect/metadata/
  2. Check local.meta file and search entries starting with [db_inputs/<DB INPUT NAME>], here you need to add owner = <OWNER NAME>
    So after modification each db_inputs entry will look something like

    [db_inputs/<DB INPUT NAME>]
    access = read : [ admin, db_connect_admin, db_connect_user ], write : [ admin, db_connect_admin ]
    export = none
    owner = <OWNER NAME>
    version = 6.4.5
    modtime = 1504709637.167172000
    
  3. Restart splunk service and now try to delete inputs from SplunkWeb.

I hope this helps.

Thanks,
Harshil

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...