topic Splunk DB Connect 2.2.0 - The Configuration works but I can't find data in my "Search & Reporting" window in All Apps and Add-ons

Splunk DB Connect 2.2.0 - The Configuration works but I can't find data in my "Search & Reporting" window

yzimmer — Mon, 11 Jul 2016 11:52:38 GMT

Hi!

I use Splunk Enterprise 6.3.3 (I also tried before with the Splunk Enterprise 6.4) with the app Splunk DB Connect 2.2.0 (I also tried with Splunk DB Connect 2.1.3)

It's always the same problem... I can configure easily Splunk DB Connect but I can't find the data ine the "Search & Reporting" window...
I don't know why because I can see the data in Operations/DB Inputs/MyInput/Choose and Preview Table......

In MyInput they say that i'm in "valid connection"...

At the step 4/4 they say "succesfully"

All work but I can searche in "Search & Reporting"

Can you help me please? I don't understand...

Thanx a lot

Re: Splunk DB Connect 2.2.0 - The Configuration works but I can't find data in my "Search & Reporting" window

TStrauch — Mon, 11 Jul 2016 12:24:57 GMT

Hi, would be nice to know what your SPL-Command looks like.

Have you created an extra index and/or sourcetype for the DBConnect Data? Make sure you are searching against this specific index. (index= .... ).
If your index is not searched by default for the admin role you will get no results by simply doing [sourcetype=xxxx] or stuff like this.

Re: Splunk DB Connect 2.2.0 - The Configuration works but I can't find data in my "Search & Reporting" window

yzimmer — Mon, 11 Jul 2016 13:21:01 GMT

Hi TStrauch!

My Splunk Command to search is just "*".

In DB Input/MyInput/Metadata I just write :
Source : dbx2.log
Sourcetype : dbx2
Index : main
Select Reource Pool : local

Re: Splunk DB Connect 2.2.0 - The Configuration works but I can't find data in my "Search & Reporting" window

ryanoconnor — Mon, 11 Jul 2016 14:10:30 GMT

Do you have a Splunk enterprise license?

What schedule is your DB input set to run at?

Re: Splunk DB Connect 2.2.0 - The Configuration works but I can't find data in my "Search & Reporting" window

yzimmer — Tue, 12 Jul 2016 07:59:16 GMT

Hi Ryanoconnor!

I have got Splunk Enterprise, I got it for free and I paid nothing : So I have got the "Enterprise Trial License" :

link text
http://www.hostingpics.net/viewer.php?id=367085licensing.png

Thanx for your answer!

Re: Splunk DB Connect 2.2.0 - The Configuration works but I can't find data in my "Search & Reporting" window

ryanoconnor — Tue, 12 Jul 2016 11:38:38 GMT

Unfortunately according to the documentation for DB Connect:

"Splunk DB Connect has not been tested and is not supported with Splunk Cloud, Splunk Free, or Splunk Light."

http://docs.splunk.com/Documentation/DBX/2.2.0/DeployDBX/Prerequisites#Splunk_Enterprise

Re: Splunk DB Connect 2.2.0 - The Configuration works but I can't find data in my "Search & Reporting" window

yzimmer — Tue, 12 Jul 2016 13:58:21 GMT

Do you mean that Enterprise trial license is the same as Splunk Cloud, Splunk Free, or Splunk Light?

Thanx

Re: Splunk DB Connect 2.2.0 - The Configuration works but I can't find data in my "Search & Reporting" window

ryanoconnor — Tue, 12 Jul 2016 16:56:20 GMT

Correct, an enterprise Trial license is Splunk Free

http://www.splunk.com/en_us/products/splunk-enterprise/free-vs-enterprise.html

Re: Splunk DB Connect 2.2.0 - The Configuration works but I can't find data in my "Search & Reporting" window

JoanHorikawa — Tue, 14 Feb 2017 05:50:34 GMT

Hi ryanoconnor, Hi yzimmer,

I have the same problem except I'm using the Enterprise test/dev license. Does the DBConnect not work with this license as well?

Thanks in advance.