topic Re: Splunk DB Connect: Data not indexing in All Apps and Add-ons

Splunk DB Connect: Data not indexing

behudelson — Thu, 10 Jan 2019 14:29:42 GMT

Hello, I have a test server and I am trying to use DBConnect to index some SQL data.

Everything appears to be configured appropriately.
In the input configuration screen, my search returns results. I've attached an image of the edit input screen.

I am running DB Connect version 3.1.4 on Splunk Enterprise 7.0.3 with a dev/test license.
Thank you for any help you can provide!

Re: Splunk DB Connect: Data not indexing

MousumiChowdhur — Fri, 11 Jan 2019 12:43:38 GMT

Hi @behudelson ,

What's your type of input, batch or rising and how are you deciding your timestamp?

Re: Splunk DB Connect: Data not indexing

behudelson — Fri, 11 Jan 2019 13:13:29 GMT

Hi @MousumiChowdhury, Thanks for asking. My input is batch and my timestamp is current time. The query takes about 5 seconds to return results from the SQL editor. No template is selected.

Re: Splunk DB Connect: Data not indexing

maciep — Fri, 11 Jan 2019 16:21:14 GMT

dumb question, did you create the index?

you can always search the _internal index for your input name to see if there are any errors (I believe dbconnect has a health dashboard where you may be able to see similar log data)

Re: Splunk DB Connect: Data not indexing

behudelson — Tue, 29 Sep 2020 22:41:43 GMT

Not a dumb question, but yes, I created the index 🙂

Also, I did search _internal and the log entries aren't very useful. This 'status=FAILED' doesn't give me much information. (I obfuscated sensitive details with ++++)

2019-01-10 10:16:00.202 -0500 INFO c.s.dbx.server.task.listeners.JobMetricsListener - action=collect_job_metrics connection=+++++++ jdbc_url=jdbc:jtds:sqlserver://++++++++++:14330/IntegrationMart;useCursors=true;domain=+++++++;useNTLMv2=false db_read_time=2 hec_record_process_time=23 format_hec_success_count=57 status=FAILED input_name=++++++++++_fact batch_size=1000 error_threshold=N/A is_jmx_monitoring=false start_time=2019-01-10_10:16:00 end_time=2019-01-10_10:16:00 duration=190 read_count=57 write_count=0 filtered_count=0 error_count=0

Re: Splunk DB Connect: Data not indexing

dhirendra761 — Mon, 14 Jan 2019 07:46:38 GMT

hi @behudelson Which Operating Sysytem (OS) you are using... Is it Microsoft Server ??

Re: Splunk DB Connect: Data not indexing

behudelson — Mon, 14 Jan 2019 13:40:50 GMT

Hi @dhirendra761, Thanks for responding. MS Server 2016.

Re: Splunk DB Connect: Data not indexing

dhirendra761 — Tue, 15 Jan 2019 09:18:44 GMT

Hi @behudelson ,

I got this issue and it's related to HEC (HTTP Event Collector) Error, DB Connect ingest data in Splunk using HEC. Unfortunalely this problem will occur only with MS server and DB Connect v 3.1.3. refer(https://answers.splunk.com/answers/710632/splunk-dbconnect-is-not-creating-sourcetype.html)

To Reslove this issue, you need to uninstall DBConnect APP 3.1.3 and Install its previous version DBConnect 3.1.2.

Also DBConnect 3.1.2 is not available in SplunkBase. Please share your email ID. I will provide to you.

Thanks.
Dhirendra

Re: Splunk DB Connect: Data not indexing

dhirendra761 — Tue, 15 Jan 2019 09:20:55 GMT

Hi @behudelson Install DBConnect v 3.1.2 and then check. Please share email ID if you want DBConnect v 3.1.2 app.

Re: Splunk DB Connect: Data not indexing

behudelson — Tue, 15 Jan 2019 13:46:40 GMT

Hi @dhirendra761, -------------- is my email. Thank you!

Re: Splunk DB Connect: Data not indexing

dhirendra761 — Tue, 15 Jan 2019 14:58:07 GMT

Shared....

Re: Splunk DB Connect: Data not indexing

dhirendra761 — Tue, 15 Jan 2019 15:11:55 GMT

Hi @behudelson ,

I got this issue and it's related to HEC (HTTP Event Collector) Error, DB Connect injects data in Splunk using HEC. Unfortunately, this problem will occur only with MS server and DB Connect v 3.1.3.

To resolve this issue, you need to uninstall DBConnect v3.1.3 and Install DBConnect v3.1.2.

Thanks.
Dhirendra

Re: Splunk DB Connect: Data not indexing

behudelson — Tue, 15 Jan 2019 15:28:59 GMT

Hi @dhirendra761 I may not have a chance to test this out until Thursday, but as soon as I confirm that it works I will accept your answer. Thank you for taking the time to assist me!

Re: Splunk DB Connect: Data not indexing

dhirendra761 — Wed, 16 Jan 2019 14:01:45 GMT

Sure.. Thank you @behudelson

Re: Splunk DB Connect: Data not indexing

behudelson — Tue, 29 Sep 2020 22:47:53 GMT

Hi @dhirendra761 I installed 3.1.2 but it just hands at the Set Up DB Connect. My installation steps were: delete splunk_app_db_connect folder from apps containing 3.1.3. Install 3.1.3 from Manage Apps-> Install app from file.

I also noticed that there is a version 3.1.4. Does it also have the same issue with Server 2016?

Re: Splunk DB Connect: Data not indexing

dhirendra761 — Tue, 29 Sep 2020 22:49:25 GMT

Hi @behudelson Did you restart the splunk after removing dbconnect app folder.
Please follow the process below:
1- Remove the splunk_app_db_connect folder from apps
2- Restart the splunk(then it will remove app completely otherwise not)
3- Install DBConnect v3.1.2

Thanks.

Re: Splunk DB Connect: Data not indexing

dhirendra761 — Fri, 18 Jan 2019 05:00:31 GMT

I never check for v3.1.4

Re: Splunk DB Connect: Data not indexing

behudelson — Fri, 18 Jan 2019 13:18:46 GMT

Thanks @dhirendra761. I did not restart after removing the folder. I will give that a shot today. I appreciate your time!!

Re: Splunk DB Connect: Data not indexing

behudelson — Fri, 18 Jan 2019 14:35:47 GMT

Thanks @dhirendra761! For some reason I needed a fresh installation of Splunk Enterprise in order for 3.1.2 to function, but now everything is good to go. I appreciate your help!

Re: Splunk DB Connect: Data not indexing

alemarzuTM — Tue, 12 Mar 2019 17:48:22 GMT

@dhirendra761

Hello there, Im having the same issue, could you send me DB Connect v.3.1.2 please? That version is not available at splunkbase.

email id: ...

Best regards,
AM.