{
    "uc_ref": "splk_dbconnect",
    "uc_vendor": "Splunk",
    "uc_description": "Monitors the Splunk DBConnect inputs, triggers if a DBConnect modular input is disabled",
    "uc_category": "splunk_data_collection",
    "uc_earliest": "-5m",
    "uc_latest": "now",
    "uc_cron": "*/5 * * * *",
    "uc_search": "| rest splunk_server=local /servicesNS/nobody/splunk_app_db_connect/configs/conf-db_inputs/\n| eval status=case(disabled=0, 1, disabled=1, 2, 1=1, 3), object=\"input:\" . title . \"|index:\" . index . \"|\" . sourcetype, alias=object\n| eval object_description=\"DBinput from connection: \" . connection . \" for index: \" . index . \", sourcetype: \" . sourcetype\n\n``` alert if inactive for more than 3600 sec```\n| eval max_sec_inactive=3600"
}