topic Re: DB connect issue in Splunk Search

DB connect issue

vin02ptl — Tue, 30 Jun 2020 14:18:59 GMT

Hi Team,

I have created connection for oracle DB in db connect app. When i am trying to run the sql query in DB connect i can see the result. But when i am trying to search the same result in search head using index and source , not getting any result.

Re: DB connect issue

richgalloway — Tue, 30 Jun 2020 14:50:40 GMT

You created a DBX connection. Did you also create an input?
Please share the search you are using on the SH.

Re: DB connect issue

vin02ptl — Tue, 30 Jun 2020 15:04:51 GMT

inputs ,identities ,connection etc all I have created .It was working some time before but not working now. There is no change in credentials and I could see the result with sql query. I using search "index=*** source=***" in SH to find the data.

Re: DB connect issue

richgalloway — Tue, 30 Jun 2020 15:27:45 GMT

Is the input still running?
What messages are you seeing in splunkd.log or the dbx logs?

Re: DB connect issue

vin02ptl — Tue, 30 Jun 2020 16:51:23 GMT

dbx logs i can see status=complete

Re: DB connect issue

richgalloway — Tue, 30 Jun 2020 17:19:44 GMT

Does the log say how many rows were returned from the DB? If it's zero then that would explain why your search doesn't find anything.