https://community.splunk.com/t5/Knowledge-Management/Best-practice-to-install-configure-DB-connect-in-a-distributed/m-p/68654#M7274 <P>In order to use database inputs, the recommendation is to install DB Connect on a (dedicated) heavy forwarder. This forwarder should be configured to forward the data to all indexers using load-balancing.</P> <P>In order to use reporting features, such as lookups, ad-hoc queries or dboutput, DB Connect needs to be install on the search heads as well. Setup on search heads with pooling enabled requires some additional steps, see: <A href="http://splunk-base.splunk.com/answers/68598/java-access-bridge-not-running-with-search-head-pooling/72263">http://splunk-base.splunk.com/answers/68598/java-access-bridge-not-running-with-search-head-pooling/72263</A></P> Wed, 19 Jun 2013 15:38:20 GMT ziegfried 2013-06-19T15:38:20Z https://community.splunk.com/t5/Knowledge-Management/Best-practice-to-install-configure-DB-connect-in-a-distributed/m-p/68653#M7273 <P>How should we install DB Connect in a distributed environment? We've read <A href="http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Otherdeploymentconsiderations">http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Otherdeploymentconsiderations</A> but still aren't sure.</P> <P>We have 2 search heads with search head pooling. <BR /><BR /> We have 3 indexers that are all receivers and search peers of the search heads. <BR /><BR /> We have 1 utility box we can dedicate to DB Connect.</P> <P>We're not sure if it should be a search head (not pooled) or a heavy forwarder. </P> <P>We think we'd like to make the utility box a heavy forwarder dedicated to DB Connect, but are there any downsides? <BR /> Can we then search the db connect data from our pooled search heads? <BR /><BR /> Will the db connect split across our 3 indexers be fully searchable? <BR /><BR /> Do we need to install anything on the search heads? </P> <P>Also, we have 1 deployment server. From the docs, it looks like we would not use that to manage any DB Connect config. Is that right?</P> Wed, 19 Jun 2013 14:50:03 GMT https://community.splunk.com/t5/Knowledge-Management/Best-practice-to-install-configure-DB-connect-in-a-distributed/m-p/68653#M7273 chang1800 2013-06-19T14:50:03Z https://community.splunk.com/t5/Knowledge-Management/Best-practice-to-install-configure-DB-connect-in-a-distributed/m-p/68654#M7274 <P>In order to use database inputs, the recommendation is to install DB Connect on a (dedicated) heavy forwarder. This forwarder should be configured to forward the data to all indexers using load-balancing.</P> <P>In order to use reporting features, such as lookups, ad-hoc queries or dboutput, DB Connect needs to be install on the search heads as well. Setup on search heads with pooling enabled requires some additional steps, see: <A href="http://splunk-base.splunk.com/answers/68598/java-access-bridge-not-running-with-search-head-pooling/72263">http://splunk-base.splunk.com/answers/68598/java-access-bridge-not-running-with-search-head-pooling/72263</A></P> Wed, 19 Jun 2013 15:38:20 GMT https://community.splunk.com/t5/Knowledge-Management/Best-practice-to-install-configure-DB-connect-in-a-distributed/m-p/68654#M7274 ziegfried 2013-06-19T15:38:20Z https://community.splunk.com/t5/Knowledge-Management/Best-practice-to-install-configure-DB-connect-in-a-distributed/m-p/68655#M7275 <P>ziegfried, Thanks for your speedy answer.</P> Wed, 19 Jun 2013 16:10:04 GMT https://community.splunk.com/t5/Knowledge-Management/Best-practice-to-install-configure-DB-connect-in-a-distributed/m-p/68655#M7275 chang1800 2013-06-19T16:10:04Z https://community.splunk.com/t5/Knowledge-Management/Best-practice-to-install-configure-DB-connect-in-a-distributed/m-p/68656#M7276 <P>Another way of approaching this problem could be the following:</P> <P>1) If you plan to use DBConnect for data enrichments, only (Db lookups and so on, mainly search-time) you could install it on a Search Head.<BR /> 2) if you plan to rely strongly on database inputs, you should evaluate expected volumes:<BR /> Small =&gt; install DB Connect on a search head and make it forward events to the indexer(s)<BR /> Medium =&gt; install DB Connect on a dedicated Splunk heavy forwarder </P> <H2>Large =&gt; install DB Connect on multiple Splunk heavy forwarder </H2> <P>source: <A href="http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Otherdeploymentconsiderations">http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Otherdeploymentconsiderations</A></P> Wed, 18 Feb 2015 15:16:48 GMT https://community.splunk.com/t5/Knowledge-Management/Best-practice-to-install-configure-DB-connect-in-a-distributed/m-p/68656#M7276 banchio 2015-02-18T15:16:48Z https://community.splunk.com/t5/Knowledge-Management/Best-practice-to-install-configure-DB-connect-in-a-distributed/m-p/68657#M7277 <P>Hi - Can you point me to install steps for DBConnect on Windows heavy forwarder?</P> Wed, 18 Mar 2015 21:03:22 GMT https://community.splunk.com/t5/Knowledge-Management/Best-practice-to-install-configure-DB-connect-in-a-distributed/m-p/68657#M7277 pkapila 2015-03-18T21:03:22Z https://community.splunk.com/t5/Knowledge-Management/Best-practice-to-install-configure-DB-connect-in-a-distributed/m-p/68658#M7278 <P>How can we use reporting feature as we are using search head clustering and as per doc it is not supported there?</P> Mon, 11 Apr 2016 06:40:49 GMT https://community.splunk.com/t5/Knowledge-Management/Best-practice-to-install-configure-DB-connect-in-a-distributed/m-p/68658#M7278 hemendralodhi 2016-04-11T06:40:49Z