Getting Error when connecting to HPC primary database in Splunk DB Connect - I/O Error: DB server closed connection.

[wm]

I/O Error: DB server closed connection.

Hi all, I am getting this error above when connecting to HPC primary database, secondary database connection works well on splunk db connect with exact same settings. From memory, hpc primary database connection used to be working too.

I am using MS-SQL Server using jTDS Driver with Windows Authentication 

jdbc:jtds:sqlserver://<ServerName>:<port number>/master;useCursors=true;domain=<domain_name>;useNTLMv2=true

FYI this worked well for hpc secondary database with same configurations except <ServerName>

[livehybrid]

Hi @wm 

Given that you are using the same connection details and the servers should be setup the same, it feels like the issue could be either network related or authentication related, as you have proven Splunk to be working.

Try and establish a telnet connection between your Splunk host and the non-working database host on the relevant DB port. If this works then it demonstrates that the firewall is allowing connection.

Double check the authentication credentials - are you using different passwords for the 2 databases or are they using a domain account? If a domain account, does it have the relevant permissions for the non-working server? 

Are there any logs you can see on the database server around the connection?

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[wm]

Thanks @livehybrid , i used telnet on the db port and it works so likely not a fire wall issue.

I am using a service account for both db hosts and one of them is not working. How do i check permissions?

I have access to the server in splunk db connect, but can you point me to the relevant logs? I am using windows.

[isoutamo]

All DB Connect logs are stored into _internal index. You can found those e.g. by using
source=*splunk_app_db
See more from https://docs.splunk.com/Documentation/DBX/3.18.2/DeployDBX/Troubleshooting

[wm]

I checked that can't find anything concrete and also on the server when splunk db connect is at. eg. dbx.log etc

[kiran_panchavat]

@wm 

Did you check the primary server is reachable from the Splunk server:  telnet <ServerName> <port>.

Given the secondary database works, the issue is likely network-related (firewall, port, DNS) or authentication-related on the primary server. Ensure that no firewalls, network security groups, or proxies are blocking or interrupting the connection between the Splunk server and the HPC primary database.

[wm]

hi @kiran_panchavat , thanks for your reply. telnet works so not sure what is the issue here