Data not being populated from SplunkDB Connect

dm2 — Wed, 07 Feb 2024 07:45:48 GMT

Hi,

I have a connection on Splunk DB Connect on my HF (connected to my SH and I know connection is stable and other sources reach my SH from the HF) but data is not populated on my index (I also tried connecting to a new index=database on my SH and HF and restarting and did not work)

Re: Data not being populated from SplunkDB Connect

Richfez — Fri, 09 Feb 2024 14:01:10 GMT

By "Search head" you mean something like an all-in-one Splunk install, right? Indexer, SH, etc... all in a single box?

I think a quick outline of how this should work might help

The HF with DB Connect will have an outputs.conf set up that points to your Indexer/SH
The Indexer/SH will have receiving turned on
So when your HF "collects" data using DB Connect, it puts that data into an index that's on the indexer.

So if I had to make a primary guess, it's that you didn't hook the HF up to the SH/IDX to send it's data there, so what it's doing is saving the data into an index _on the local HF_ instead of on your primary SH/Indexer.

Some docs to read - I promise they're pretty good too! But double check you've done all the steps in both -

https://docs.splunk.com/Documentation/Splunk/9.2.0/Forwarding/Enableareceiver

https://docs.splunk.com/Documentation/Splunk/9.2.0/Forwarding/Deployaheavyforwarder

If that doesn't work, let us know what you did and what it's now doing.

Also you could check DB Connect's various "monitoring" pages to see what they say about what's happening. Maybe you just have some other error or forgot to schedule the DB input or something.

topic Data not being populated from SplunkDB Connect in Splunk Search

Data not being populated from SplunkDB Connect

Re: Data not being populated from SplunkDB Connect