Hi
I need to save the db connect tmp files for debugging purposes. Is there a way to tell db connect to save them?
DB Connect creates a batch input for moving data to Splunk. The batch input is defined in $SPLUNK_HOME/etc/apps/dbx/local/inputs.conf
[batch://$SPLUNK_HOME/var/spool/dbmon/*.dbmonevt]
crcSalt = <SOURCE>
disabled = 0
move_policy = sinkhole
sourcetype = dbmon:spool
You can simply disable this input, then it won't be deleted (and indexed). To continue to index the data and still preserve the files, you could turn it into a regular file monitor:
[monitor://$SPLUNK_HOME/var/spool/dbmon/*.dbmonevt]
crcSalt = <SOURCE>
disabled = 0
sourcetype = dbmon:spool
DB Connect creates a batch input for moving data to Splunk. The batch input is defined in $SPLUNK_HOME/etc/apps/dbx/local/inputs.conf
[batch://$SPLUNK_HOME/var/spool/dbmon/*.dbmonevt]
crcSalt = <SOURCE>
disabled = 0
move_policy = sinkhole
sourcetype = dbmon:spool
You can simply disable this input, then it won't be deleted (and indexed). To continue to index the data and still preserve the files, you could turn it into a regular file monitor:
[monitor://$SPLUNK_HOME/var/spool/dbmon/*.dbmonevt]
crcSalt = <SOURCE>
disabled = 0
sourcetype = dbmon:spool
Good stuff! Thanks.