Why do inputs from DB Connect absolutely refuse to use my SourceType?

jroeser1404 — Thu, 02 Mar 2023 04:16:12 GMT

I'm using DB Connect to input some data from Oracle. I have Splunk installed on a Windows 2016 Server. I cannot seem to get any of my sourcetypes read or used with an input created via DB Connect. No matter what I do, if I run a search from the "Find Events" button of the DB Connect application, then click on "+Extract New Fields", it returns an error:

"The events associated with this job have no sourcetype information: ".

Every. Single. Time.

Sample query:

index=thejoy sourcetype=WHYNOT source=JUSTWORKSERIOUSLY OR source=mi_input://JUSTWORKSERIOUSLY

Interestingly enough, if I run the following query I get the EXACT same results:

index=thejoy source=JUSTWORKSERIOUSLY OR source=mi_input://JUSTWORKSERIOUSLY

I get data back from both of these results, but am unable to extract new fields. I have tried doing the following:

*Creating a new Index and assigning it to splunk_app_db_connect
*Creating a new Index and assigning it to search
*Creating a new SourceType via Settings > SourceTypes and setting it to Searching & Reporting
*Creating a new SourceType via Settings > SourceTypes and setting it to Splunk DB Connect
*Specified the Application for the Data Input to be DB Connect
*Specified the Application for the Data Input to be the Splunk Search
*Changing Permissions on DB Connect to allow Everyone to Read/Write
*Creating a new user and doing all of the above
*In DB Connect, typing a new value for SourceType that doesn't exist so it gets created automatically

No matter what I try, I just seem to get the same message about no sourcetype information being available for the job.

If I create a new source type via Settings > SourceTypes in the main splunk menu, it doesn't show up in the list for DB Connect (which I understand is a bug). This changes very little, since it's apparently not being used anyways.

If I let DB Connect create a new sourcetype, I do not see it appear in the Settings > SourceTypes menu after the DB Input is created and a successful search is executed.

Also, when I check the props.conf file located in:

C:\Program Files\Splunk\etc\apps\splunk_app_db_connect\local\

my sourcetype is not present at all in the file; it's just an empty file.

I'm just simply at a loss here on why this is happening and what to do. I just want my DB Inputs to recognize my sourcetypes. Ultimately, I want to parse my data as it is going into Splunk using a specific source type. I'm at the point where I'm considering doing a fresh install of Splunk. Any help on this extremely frustrating issue would be greatly appreciated.

topic Why do inputs from DB Connect absolutely refuse to use my SourceType? in Getting Data In

Why do inputs from DB Connect absolutely refuse to use my SourceType?