All Apps and Add-ons

Is it normal to receive multiple "invalid key in stanza" errors in the configuration file of the db_connect app?

efaundez
Path Finder

good morning

   Splunk reports too many errors in the configuration file of the db_connect app. These configurations are made via web and they validate that the connections are working correctly.

   Does anyone know if this is normal or if there really is a problem defining the connection to the database?

 Invalid key in stanza [conex] in /home/splunk/splunk/etc/apps/splunk_app_db_connect/local/db_connections.conf, line 563: jdbcUrlFormat     (value:  jdbc:oracle:thin:@<host>:<port>:<database>).
 Invalid key in stanza [conex] in /home/splunk/splunk/etc/apps/splunk_app_db_connect/local/db_connections.conf, line 564: jdbcUrlSSLFormat  (value:  jdbc:oracle:thin:@(DESCRIPTION=(ADDRESS=(PROTOCOL=tcps)(HOST=<host>)(PORT=<port>))(CONNECT_DATA=(SERVICE_NAME=<database>)))).

[conex]
connection_type = oracle
cwallet_location = /home/oracle/cwallet.sso
database = database_conex
host = 1.1.1.1
identity = conex_user
jdbcUrlFormat = jdbc:oracle:thin:@<host>:<port>:<database>
jdbcUrlSSLFormat = jdbc:oracle:thin:@(DESCRIPTION=(ADDRESS=(PROTOCOL=tcps)(HOST=<host>)(PORT=<port>))(CONNECT_DATA=(SERVICE_NAME=<database>)))
port = 1521
1 Solution

sylim_splunk
Splunk Employee
Splunk Employee

It appears they are left-overs from your previous versions. Check it out if the version you are using has the parameters in the docs - they are there in the docs for 2.x versions but no longer appear in 3.x versions.
If that's the case you can comment them out in the db_connections.conf and restart splunk.

View solution in original post

0 Karma

sylim_splunk
Splunk Employee
Splunk Employee

It appears they are left-overs from your previous versions. Check it out if the version you are using has the parameters in the docs - they are there in the docs for 2.x versions but no longer appear in 3.x versions.
If that's the case you can comment them out in the db_connections.conf and restart splunk.

0 Karma
Get Updates on the Splunk Community!

Infographic provides the TL;DR for the 2024 Splunk Career Impact Report

We’ve been buzzing with excitement about the recent validation of Splunk Education! The 2024 Splunk Career ...

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...