How do I implement the Splunk DB Connect app in a distributed environment?

[Jeremiah]

Assuming I'm going to use the app to perform database lookups, is it necessary to install and configure the app on both the indexers and the search heads? Or do I only need to install it on the search heads?

[jcoates_splunk]

Hi,

we've just released DB Connect 1.1, which can now be installed on a search head pool.

app

search head pooling docs

Thanks,
Jack

[Dan · Accepted solution]

In version 1.0.7 there is no way to distribute lookups across indexers, short of setting up DB Connect on each of the indexers and configuring the same lookup on each one.

Instead, install on the search head. When you run lookups, use either one of the following to force the lookup from being distributed:

• | localop | lookup
• | lookup local=1

The reason for this is that the Java Bridge, for security reasons, must run locally on the instance that is querying the database. When Splunk replicates the dblookup.py script to indexers, which is part of the usual bundle replication done for all distributed searches, the dblookup.py on the indexer finds itself unable to query the database.

[Jeremiah]

Thanks. So, if I do put DB Connect on each indexer and configure the lookup exactly the same, it will work? And is there any plan to include the ability to distribute the lookups in the future?