How to get state of Splunk DB Connect App input?

[Muryoutaisuu]

Hi guys

Recently we updated the DB Connect App from 2.2.4 to 3.1.0.
In the old version we used to alert disabled inputs via REST with this search:

|rest splunk_server=local /servicesNS/-/-/configs/inputs
|rename eai:acl.app as app
|search app="splunk_app_db_connect" title="mi_input://*"
|table title,connection,disabled,updated
|where disabled=1

Unfortunately it no longer works. The query

|rest splunk_server=local /servicesNS/-/-/configs/inputs |rename eai:acl.app as app | search app="splunk_app_db_connect"

returns only 2 lines, but I expect it to return our ~70 input definitions.

Does anyone know of another query?

Thanks in advance and kind regards
- Muryoutaisuu

[corey_dick · Accepted solution]

I believe that you are looking for the following:

| rest splunk_server=local /servicesNS/-/-/configs/conf-db_inputs/

I had been searching for this as well and found a post about DB Connect connections that got me thinking in the right direction to figure this out.

[Muryoutaisuu]

Yes, that was absolutetly what I was searching for.
In the meantime I contacted the support and it's no longer necessary, to monitor for automatically disabled inputs, as they won't be automatically disabled anymore.