Monitor SQLite database file with Splunk DB Connect

tmontney — Tue, 29 Sep 2020 16:08:56 GMT

Update

I realized I needed to create an identity, according to the first link. I created one to mirror the config with no password. Now it's saying it can't get schemas.

I read the following articles:

https://www.splunk.com/blog/2016/09/13/using-db-connect-with-sqlite.html
http://docs.splunk.com/Documentation/DBX/3.1.1/DeployDBX/Installdatabasedrivers#Install_drivers_for_other_databases

Latest DB Connect is running, Java 8 is installed, and SQL Explorer (under Data Lab) lists my connection. When I select my DB from the dropdown menu, I get "Invalid Database Connection". I can't find anything in the logs as to why it thinks that. I can see the SQLite driver listed under Drivers.

Configuration under ...\Splunk\etc\apps\splunk_app_db_connect\local

db_connection_types.conf

[sqlite]
 displayName = SQLite
 serviceClass = com.splunk.dbx2.DefaultDBX2JDBC
 jdbcDriverClass = org.sqlite.JDBC
 jdbcUrlFormat = jdbc:sqlite:<database>
 ui_default_catalog = $database$

db_connections.conf

[default]
useConnectionPool = true
maxConnLifetimeMillis = 1800000
maxWaitMillis = 30000
maxTotalConn = 8
fetch_size = 100

[VPN]
connection_type = sqlite
database = C:/Rest/DB.SQLite
host = localhost
identity = owner
jdbcUrlFormat = jdbc:sqlite:<database>
jdbcUseSSL = 0

Tried database = C:\Rest\DB.SQLite, jdbcUrlFormat = jdbc:sqlite://<database>, and database = C:\\Rest\\DB.SQLite.

Re: Monitor SQLite database file with Splunk DB Connect

tmontney — Tue, 29 Sep 2020 16:08:58 GMT

Seems the answer is creating an identity, a step I missed due to quick reading. Created it to match the identity name in db_connections.conf, with no password. The schema error is likely due to it being an unsupported and server-less DB.

http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Createandmanageidentities

Final configs are as follows:

db_connections.conf

[default]
useConnectionPool = true
maxConnLifetimeMillis = 1800000
maxWaitMillis = 30000
maxTotalConn = 8
fetch_size = 100

[VPN]
connection_type = sqlite
database = C:\Rest\DB.sqlite
host = localhost
identity = owner
jdbcUrlFormat = jdbc:sqlite:<database>
jdbcUseSSL = 0

db_connection_types.conf

[sqlite]
 displayName = SQLite
 serviceClass = com.splunk.dbx2.DefaultDBX2JDBC
 jdbcDriverClass = org.sqlite.JDBC
 jdbcUrlFormat = jdbc:sqlite:<database>
 ui_default_catalog = $database$

topic Monitor SQLite database file with Splunk DB Connect in All Apps and Add-ons

Monitor SQLite database file with Splunk DB Connect

Re: Monitor SQLite database file with Splunk DB Connect