Splunk® DB Connect

Deploy and Use Splunk DB Connect

Download manual as PDF

NOTE - Splunk DB Connect version 1.x reached its End of Life on July 28, 2016. Please see the migration information.
This documentation does not apply to the most recent version of DBX. Click here for the latest version.
Download topic as PDF


# Copyright (C) 2005-2015 Splunk Inc. All Rights Reserved.
# The master configuration file. Global settings for Java and Splunk DB Connect are
# configured in here.

# Java settings #

home = <path>
* Path to the Java JRE or JDK installation directory

options = <string>
* Arbitrary Java command line options
* For example memory settings or system properties


addr = <bind address>
* The address/interface the Java Bridge server should listen for
* connections on.
* In most cases only localhost makes sense.

port = <bind port>
* The port the Java Bridge server should listen for connections on.

threads = <n>
* The size of the thread pool for Java Bridge command execution.
* This defines the number of commands that can run concurrently

debug = true|false
* Turn on debugging for the Java Bridge client


* The global logging severity

file = <filename>
* The filename for the Splunk DB Connect logfile which is placed at
* $SPLUNK_HOME/var/log/splunk

console = true|false
* Enable or disable STDOUT output of log events. (only for debugging).

logger.<logger_name> = INFO|DEBUG|WARN|ERROR|FATAL
* Override the global log level for a specific logger

sslVersion = <SSLv3, TLSv1>
* The ssl algorithm for the splunkd connection


global = <store type>
* The type used for the global persistent store.
* - xstream: Data is stored in XML flatfiles. These files are readable
*            and easy to inspect and change
* - jdbm: Data is stored in a btree key-value database. The performance
*         is better for big amounts of data but the files are binary.

type.<type_name> = <fqcn>
* A type definition for a implementation of the PersistentValueStore interface


adapter = <config_adapter>
* A class implementing the com.splunk.config.ConfigurationAdapter interface

cache = true|false
* Enable or disable caching of configuration values


default.channel = <string>
* A channel is a way on how to get data into Splunk. Currently this is
* done using the "spool" channel. There will be other options in future.

default.timestamp.format = <string>
* The default format of timestamp values for events generated by DBmon.
* The can be overridden on per-input definition basis. The format is
* expressed as Java SimpleDateFormat pattern.

type.<type> = <string>
* Allows the registration of a output channel
*(a class implementing com.splunk.output.SplunkOutputChannel)

format.<format> = <string>
* Allows the registration of a output format
* (a class implementing com.splunk.dbx.monitor.output.OutputFormat)

default.type = <softref|lru>
cleaner.interval = <relative_time_expression>

keep-alive.timeout = <relative_time_expression>

# Database settings #

database.factory = persistent|default
* The database connection factory to use

database.factory.pooled = true|false
* Enable database pooling

pool.maxActive = <n>
* The maximum number of active database connections

pool.maxIdle = <n>
* The maximum number of idle database connections

cache.tables = true|false
* Turn on caching of table metadata information

cache.tables.size = <n>
* The size of the table metadata cache

cache.tables.invalidation.timeout = <relative_time_expression>
* The amount of time before the cached metadata information of a table is
* considered invalid and fetched again

preload.config = [true|false]
* When enabled, the database factory will fetch and check all configured
* database on startup. Otherwise there fetched when they are used for the
* first time.

query.stream.limit = <n>
* Force streaming results for queries with a max. result limit greater than this (default is 10000).
* This setting affects only certain database types.

jdbc.streaming.fetch.size = <n>
* Number of results to be fetched at a time when streaming is enabled for a JDBC statement. It can be overridden on
* a per-database-type basis using the "streamingFetchSize" parameter in database_types.conf.
* This setting affects only certain database types
* Default is 500


threads = <n>
* The size of the thread pool for database inputs

output.channel = <string>
* The output channel to use
* - spool: Temporary files, that are moved into a file monitor sinkhole
* - rest: Events are uploaded via REST to Splunkd

output.buffer.limit = <file-size-expression>
* Only applies to the spool output channel. The max. size of the temp files, before they are moved to the sinkhole.
* Defaults to 5MB

output.time.limit = <n>
* Only applies to the spool output channel. The time limit for moving files to the sinkhole in milliseconds.
* Defaults to 5000


cache = true|false
* When set to true, database lookup definitions are cached in memory

cache.size = <n>
* The cache size for database lookups definitions (number of entries)

cache.invalidation.timeout = <relative_time_expression>
* The amount of the before a database lookup definition is considered invalid
* and removed from the cache.

init.<n> = <FQCN>


batch.size = <n>


This documentation applies to the following versions of Splunk® DB Connect: 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.11, 1.1, 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.5, 1.1.6, 1.1.7, 1.2.0, 1.2.1, 1.2.2


While mentioned in the release notes, the [splunkd] definition is not included in this spec.

sslVersion = SSLv3


sslVersion = TLSv1

April 10, 2015

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters