All Apps and Add-ons

How do I implement the Splunk DB Connect app in a distributed environment?

Jeremiah
Motivator

Assuming I'm going to use the app to perform database lookups, is it necessary to install and configure the app on both the indexers and the search heads? Or do I only need to install it on the search heads?

Tags (2)
1 Solution

Dan
Splunk Employee
Splunk Employee

In version 1.0.7 there is no way to distribute lookups across indexers, short of setting up DB Connect on each of the indexers and configuring the same lookup on each one.

Instead, install on the search head. When you run lookups, use either one of the following to force the lookup from being distributed:

  • | localop | lookup
  • | lookup local=1

The reason for this is that the Java Bridge, for security reasons, must run locally on the instance that is querying the database. When Splunk replicates the dblookup.py script to indexers, which is part of the usual bundle replication done for all distributed searches, the dblookup.py on the indexer finds itself unable to query the database.

View solution in original post

jcoates_splunk
Splunk Employee
Splunk Employee

Hi,

we've just released DB Connect 1.1, which can now be installed on a search head pool.

app

search head pooling docs

Thanks,
Jack

Dan
Splunk Employee
Splunk Employee

In version 1.0.7 there is no way to distribute lookups across indexers, short of setting up DB Connect on each of the indexers and configuring the same lookup on each one.

Instead, install on the search head. When you run lookups, use either one of the following to force the lookup from being distributed:

  • | localop | lookup
  • | lookup local=1

The reason for this is that the Java Bridge, for security reasons, must run locally on the instance that is querying the database. When Splunk replicates the dblookup.py script to indexers, which is part of the usual bundle replication done for all distributed searches, the dblookup.py on the indexer finds itself unable to query the database.

Jeremiah
Motivator

Thanks. So, if I do put DB Connect on each indexer and configure the lookup exactly the same, it will work? And is there any plan to include the ability to distribute the lookups in the future?

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...