All Apps and Add-ons

Monitor SQLite database file with Splunk DB Connect

tmontney
Builder

Update

I realized I needed to create an identity, according to the first link. I created one to mirror the config with no password. Now it's saying it can't get schemas.

I read the following articles:

https://www.splunk.com/blog/2016/09/13/using-db-connect-with-sqlite.html
http://docs.splunk.com/Documentation/DBX/3.1.1/DeployDBX/Installdatabasedrivers#Install_drivers_for_...

Latest DB Connect is running, Java 8 is installed, and SQL Explorer (under Data Lab) lists my connection. When I select my DB from the dropdown menu, I get "Invalid Database Connection". I can't find anything in the logs as to why it thinks that. I can see the SQLite driver listed under Drivers.

Configuration under ...\Splunk\etc\apps\splunk_app_db_connect\local

db_connection_types.conf

[sqlite]
 displayName = SQLite
 serviceClass = com.splunk.dbx2.DefaultDBX2JDBC
 jdbcDriverClass = org.sqlite.JDBC
 jdbcUrlFormat = jdbc:sqlite:<database>
 ui_default_catalog = $database$

db_connections.conf

[default]
useConnectionPool = true
maxConnLifetimeMillis = 1800000
maxWaitMillis = 30000
maxTotalConn = 8
fetch_size = 100

[VPN]
connection_type = sqlite
database = C:/Rest/DB.SQLite
host = localhost
identity = owner
jdbcUrlFormat = jdbc:sqlite:<database>
jdbcUseSSL = 0

Tried database = C:\Rest\DB.SQLite, jdbcUrlFormat = jdbc:sqlite://<database>, and database = C:\\Rest\\DB.SQLite.

0 Karma
1 Solution

tmontney
Builder

Seems the answer is creating an identity, a step I missed due to quick reading. Created it to match the identity name in db_connections.conf, with no password. The schema error is likely due to it being an unsupported and server-less DB.

http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Createandmanageidentities

Final configs are as follows:

db_connections.conf

[default]
useConnectionPool = true
maxConnLifetimeMillis = 1800000
maxWaitMillis = 30000
maxTotalConn = 8
fetch_size = 100

[VPN]
connection_type = sqlite
database = C:\Rest\DB.sqlite
host = localhost
identity = owner
jdbcUrlFormat = jdbc:sqlite:<database>
jdbcUseSSL = 0

db_connection_types.conf

[sqlite]
 displayName = SQLite
 serviceClass = com.splunk.dbx2.DefaultDBX2JDBC
 jdbcDriverClass = org.sqlite.JDBC
 jdbcUrlFormat = jdbc:sqlite:<database>
 ui_default_catalog = $database$

View solution in original post

tmontney
Builder

Seems the answer is creating an identity, a step I missed due to quick reading. Created it to match the identity name in db_connections.conf, with no password. The schema error is likely due to it being an unsupported and server-less DB.

http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Createandmanageidentities

Final configs are as follows:

db_connections.conf

[default]
useConnectionPool = true
maxConnLifetimeMillis = 1800000
maxWaitMillis = 30000
maxTotalConn = 8
fetch_size = 100

[VPN]
connection_type = sqlite
database = C:\Rest\DB.sqlite
host = localhost
identity = owner
jdbcUrlFormat = jdbc:sqlite:<database>
jdbcUseSSL = 0

db_connection_types.conf

[sqlite]
 displayName = SQLite
 serviceClass = com.splunk.dbx2.DefaultDBX2JDBC
 jdbcDriverClass = org.sqlite.JDBC
 jdbcUrlFormat = jdbc:sqlite:<database>
 ui_default_catalog = $database$
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...