All Apps and Add-ons

Monitor SQLite database file with Splunk DB Connect

tmontney
Builder

Update

I realized I needed to create an identity, according to the first link. I created one to mirror the config with no password. Now it's saying it can't get schemas.

I read the following articles:

https://www.splunk.com/blog/2016/09/13/using-db-connect-with-sqlite.html
http://docs.splunk.com/Documentation/DBX/3.1.1/DeployDBX/Installdatabasedrivers#Install_drivers_for_...

Latest DB Connect is running, Java 8 is installed, and SQL Explorer (under Data Lab) lists my connection. When I select my DB from the dropdown menu, I get "Invalid Database Connection". I can't find anything in the logs as to why it thinks that. I can see the SQLite driver listed under Drivers.

Configuration under ...\Splunk\etc\apps\splunk_app_db_connect\local

db_connection_types.conf

[sqlite]
 displayName = SQLite
 serviceClass = com.splunk.dbx2.DefaultDBX2JDBC
 jdbcDriverClass = org.sqlite.JDBC
 jdbcUrlFormat = jdbc:sqlite:<database>
 ui_default_catalog = $database$

db_connections.conf

[default]
useConnectionPool = true
maxConnLifetimeMillis = 1800000
maxWaitMillis = 30000
maxTotalConn = 8
fetch_size = 100

[VPN]
connection_type = sqlite
database = C:/Rest/DB.SQLite
host = localhost
identity = owner
jdbcUrlFormat = jdbc:sqlite:<database>
jdbcUseSSL = 0

Tried database = C:\Rest\DB.SQLite, jdbcUrlFormat = jdbc:sqlite://<database>, and database = C:\\Rest\\DB.SQLite.

0 Karma
1 Solution

tmontney
Builder

Seems the answer is creating an identity, a step I missed due to quick reading. Created it to match the identity name in db_connections.conf, with no password. The schema error is likely due to it being an unsupported and server-less DB.

http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Createandmanageidentities

Final configs are as follows:

db_connections.conf

[default]
useConnectionPool = true
maxConnLifetimeMillis = 1800000
maxWaitMillis = 30000
maxTotalConn = 8
fetch_size = 100

[VPN]
connection_type = sqlite
database = C:\Rest\DB.sqlite
host = localhost
identity = owner
jdbcUrlFormat = jdbc:sqlite:<database>
jdbcUseSSL = 0

db_connection_types.conf

[sqlite]
 displayName = SQLite
 serviceClass = com.splunk.dbx2.DefaultDBX2JDBC
 jdbcDriverClass = org.sqlite.JDBC
 jdbcUrlFormat = jdbc:sqlite:<database>
 ui_default_catalog = $database$

View solution in original post

tmontney
Builder

Seems the answer is creating an identity, a step I missed due to quick reading. Created it to match the identity name in db_connections.conf, with no password. The schema error is likely due to it being an unsupported and server-less DB.

http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Createandmanageidentities

Final configs are as follows:

db_connections.conf

[default]
useConnectionPool = true
maxConnLifetimeMillis = 1800000
maxWaitMillis = 30000
maxTotalConn = 8
fetch_size = 100

[VPN]
connection_type = sqlite
database = C:\Rest\DB.sqlite
host = localhost
identity = owner
jdbcUrlFormat = jdbc:sqlite:<database>
jdbcUseSSL = 0

db_connection_types.conf

[sqlite]
 displayName = SQLite
 serviceClass = com.splunk.dbx2.DefaultDBX2JDBC
 jdbcDriverClass = org.sqlite.JDBC
 jdbcUrlFormat = jdbc:sqlite:<database>
 ui_default_catalog = $database$
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...