db_inputs.conf.spec

[<name>]
description = <value>
# optional
# Description for this lookup

interval = <value>
# required
# interval to fetch data from DB and index them in Splunk
# It could be a number of seconds or a cron expression

index = <value>
# optional
# index to store events imported in Splunk
# If not specified default index is used

source = <value>
# optional
# source associated to events indexed
# By default, the stanza name will be used

sourcetype = <value>
# required
# source type associated to events indexed

host = <value>
# optional
# host associated to events indexed

mode = (batch|advanced)
# required
# Operational mode. batch or advanced.

connection = <value>
# required
# Indicates the database connection to work on.

query = <value>
# required
# SQL statement to retrieve data from remote database connection.

query_timeout = <int>
# optional
# the max execution time of a SQL, the default is 30 seconds.

max_rows = <int>
# optional
# the max rows of data retrieval. the default is all (unlimited).

fetch_size = <int>
# optional
# The number of rows to return at a time from the database. The default is 300.

batch_upload_size = <int>
# optional
# Number of rows to be uploaded to HEC in one batch.  Default is 1000.



tail_rising_column_name = <value>
# optional if batch mode
# at tail mode, the rising column is the column which is always rising as the checkpoint of the tail loading.

tail_rising_column_fullname = <value>
# optional if batch mode
# fullname of input tail rising column, currently this value is used by front end only.

tail_rising_column_number = <int>
# optional if batch mode
# at tail mode, the position of rising column in the data loading.



input_timestamp_column_name = <value>
# optional
# the input timestamp column name, the data of this column will be the event time. If not set, dbinput will use the current timestamp as the event time.

input_timestamp_column_fullname = <value>
# optional
# fullname of input timestamp column, currently this value is used by front end only.

input_timestamp_column_number = <int>
# optional
# the timestamp column number at the position of the query.


input_timestamp_format = <value>
# optional
# specify the format of input timestamp column, in JavaSimpleDateString format.


max_single_checkpoint_file_size = <int>
# optional
# Max checkpoint file size before archiving checkpoint file in bytes.  Default is 10MB, max is 100MB.



ui_query_mode = (simple|advanced)
# optional
# specify whether the ui should use simpple mode or adanced mode for SQL queries

ui_query_catalog = <value>
# optional
# in simple mode, this value will be pre-populated into the catalog dropdown

ui_query_schema = <value>
# optional
# in simple mode, this value will be pre-populated into the schema dropdown

ui_query_table = <value>
# optional
# in simple mode, this value will be pre-populated into the query dropdown

Example

[test_input]
interval = 3600
index = main
sourcetype = dummy_type
mode = batch
connection = test_connection
query = SELECT * FROM `sakila`.`actor`
max_rows = 100
ui_query_catalog = sakila
ui_query_mode = simple
ui_query_schema = NULL
ui_query_table = actor


[test_advanced_input]
interval = 3600
index = main
sourcetype = dummy_type
mode = advanced
connection = test_connection
query = SELECT * FROM `sakila`.`actor` where actor_id >= ? order by actor_id
max_rows = 100
ui_query_catalog = sakila
ui_query_mode = advanced
ui_query_schema = NULL
ui_query_table = actor
tail_rising_column_name = actor_id