topic DBconnect to SCCM database in Security

DBconnect to SCCM database

Nadhiyaa — Sun, 07 Oct 2018 12:18:54 GMT

Trying to connect to MSSQL for the SCCMdatabase. I'm trying to use a domain account, and Windows Authentication. If I try the MS_SQL Server Using MS Generic Driver with Windows Authentication, point it to the database I want to connect to, I get the following when trying to validate:
"This driver is not configured for integrated authentication." If I try MS-SQL Server Using MS Generic Driver, I get: "Login failed for user". If I try the jTDS drivers, I get connection timed out.

Can anyone help me figure this out? I'm trying to get the SCCM app working, just to see what it gives us, and I can't even get DBConnect to work.

Re: DBconnect to SCCM database

maciep — Sun, 07 Oct 2018 12:58:24 GMT

what about the kerberos option? If your splunk box is on *nix, i think that's the one to try. And of course, be sure that you specified the domain in the identity you're using.

Re: DBconnect to SCCM database

Nadhiyaa — Mon, 08 Oct 2018 07:14:31 GMT

KrbException: Cannot locate default realm

I am getting this above error

Re: DBconnect to SCCM database

smdojo — Mon, 08 Oct 2018 19:07:12 GMT

What version of DBConnect are you using? I was able to find the below response for the same issue

https://answers.splunk.com/answers/556315/splunk-db-connect-3-why-am-i-unable-to-login-using.html

Re: DBconnect to SCCM database

Nadhiyaa — Sun, 14 Oct 2018 07:12:07 GMT

I am able to connect to the SCCM database after creating a new user for Splunk giving permissions.

Re: DBconnect to SCCM database

nick405060 — Wed, 17 Oct 2018 17:47:17 GMT

I'm trying to do the same exact thing you are! SCCM app doesn't work, and I need SCCM data, so I'm trying to get it with DBConnect.

Right now if I try to validate, port 1433, read-only flag checked, enable SSL flag unchecked, for MSSQL and Windows authentication and generic driver, it does validate and tells me connection saved successfully! And the enabled flag is set to true. However, I then get a connection error (at the top of the page, not next to the validate button like if you try to validate something that is invalid) and am not sure why. It populates the default database to be "master".

Any suggestions? The permissions are the default permissions for dbconnect.

Re: DBconnect to SCCM database

Nadhiyaa — Thu, 18 Oct 2018 08:09:04 GMT

Yes it takes the default database to be "master" But you can edit the jdbc url to specify your database name.
databaseName=XXX;

Also authenticate with MS-SQL Server Using MS Generic Driver and possible create a Splunk user to access those tables . You Can check with your DB guy to do that.