All Apps and Add-ons

Monitor SQLite database file with Splunk DB Connect

Builder

Update

I realized I needed to create an identity, according to the first link. I created one to mirror the config with no password. Now it's saying it can't get schemas.

I read the following articles:

https://www.splunk.com/blog/2016/09/13/using-db-connect-with-sqlite.html
http://docs.splunk.com/Documentation/DBX/3.1.1/DeployDBX/Installdatabasedrivers#Install_drivers_for_...

Latest DB Connect is running, Java 8 is installed, and SQL Explorer (under Data Lab) lists my connection. When I select my DB from the dropdown menu, I get "Invalid Database Connection". I can't find anything in the logs as to why it thinks that. I can see the SQLite driver listed under Drivers.

Configuration under ...\Splunk\etc\apps\splunk_app_db_connect\local

db_connection_types.conf

[sqlite]
 displayName = SQLite
 serviceClass = com.splunk.dbx2.DefaultDBX2JDBC
 jdbcDriverClass = org.sqlite.JDBC
 jdbcUrlFormat = jdbc:sqlite:<database>
 ui_default_catalog = $database$

db_connections.conf

[default]
useConnectionPool = true
maxConnLifetimeMillis = 1800000
maxWaitMillis = 30000
maxTotalConn = 8
fetch_size = 100

[VPN]
connection_type = sqlite
database = C:/Rest/DB.SQLite
host = localhost
identity = owner
jdbcUrlFormat = jdbc:sqlite:<database>
jdbcUseSSL = 0

Tried database = C:\Rest\DB.SQLite, jdbcUrlFormat = jdbc:sqlite://<database>, and database = C:\\Rest\\DB.SQLite.

0 Karma
1 Solution

Builder

Seems the answer is creating an identity, a step I missed due to quick reading. Created it to match the identity name in db_connections.conf, with no password. The schema error is likely due to it being an unsupported and server-less DB.

http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Createandmanageidentities

Final configs are as follows:

db_connections.conf

[default]
useConnectionPool = true
maxConnLifetimeMillis = 1800000
maxWaitMillis = 30000
maxTotalConn = 8
fetch_size = 100

[VPN]
connection_type = sqlite
database = C:\Rest\DB.sqlite
host = localhost
identity = owner
jdbcUrlFormat = jdbc:sqlite:<database>
jdbcUseSSL = 0

db_connection_types.conf

[sqlite]
 displayName = SQLite
 serviceClass = com.splunk.dbx2.DefaultDBX2JDBC
 jdbcDriverClass = org.sqlite.JDBC
 jdbcUrlFormat = jdbc:sqlite:<database>
 ui_default_catalog = $database$

View solution in original post

Builder

Seems the answer is creating an identity, a step I missed due to quick reading. Created it to match the identity name in db_connections.conf, with no password. The schema error is likely due to it being an unsupported and server-less DB.

http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Createandmanageidentities

Final configs are as follows:

db_connections.conf

[default]
useConnectionPool = true
maxConnLifetimeMillis = 1800000
maxWaitMillis = 30000
maxTotalConn = 8
fetch_size = 100

[VPN]
connection_type = sqlite
database = C:\Rest\DB.sqlite
host = localhost
identity = owner
jdbcUrlFormat = jdbc:sqlite:<database>
jdbcUseSSL = 0

db_connection_types.conf

[sqlite]
 displayName = SQLite
 serviceClass = com.splunk.dbx2.DefaultDBX2JDBC
 jdbcDriverClass = org.sqlite.JDBC
 jdbcUrlFormat = jdbc:sqlite:<database>
 ui_default_catalog = $database$

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!