I have SPLUNK 6.3 version and have 4 indexers in the cluster. I installed SPLUNK DB Connect v2 app on the standalone dev SH.
I added a DB connection in the app, which was successfully tested (showed schema names in the preview). Then, I gave read permission to "All Apps" for the SPLUNK DB Connect 2 app (using Manage Apps), the Identity (in DBconnect 2 app), and the DB Connection (in DBconnect 2 app).
However, when I run an adhoc search query in the Search app, I get 4 errors, one for my 4 indexers each indexer.
I am wondering, why the Search app is looking in my indexers? After all, it is an adhoc db query.
P.S. The Splunk DB Connect 2 app is only installed in my standalone dev SH, not on the Indexers.
I think a few people are getting this error (myself included) but just for due-diligence, please check your 'commands.conf' file in the DBXv2 "default" directory and make sure that local is set to true. I don't think it matters but it's still worth validating.
Not working; (It is set to true already).
$ cat commands.conf
filename = dbxquery.py
supportsgetinfo = true
supportsrawargs = true
passauth = true
runinpreview = false
local = true
Any other suggestion, please!
per todd_miller, this is a newly introduced bug -- please open a support ticket so we can be sure to update you on the fix.
Thanks a lot, @jcoates_splunk !
I updated to 2.0.6 and it is working fine now 🙂