All Apps and Add-ons
Highlighted

Monitor SQLite database file with Splunk DB Connect

Contributor

Update

I realized I needed to create an identity, according to the first link. I created one to mirror the config with no password. Now it's saying it can't get schemas.

I read the following articles:

https://www.splunk.com/blog/2016/09/13/using-db-connect-with-sqlite.html
http://docs.splunk.com/Documentation/DBX/3.1.1/DeployDBX/Installdatabasedrivers#Install_drivers_for_...

Latest DB Connect is running, Java 8 is installed, and SQL Explorer (under Data Lab) lists my connection. When I select my DB from the dropdown menu, I get "Invalid Database Connection". I can't find anything in the logs as to why it thinks that. I can see the SQLite driver listed under Drivers.

Configuration under ...\Splunk\etc\apps\splunkappdb_connect\local

dbconnectiontypes.conf

[sqlite]
 displayName = SQLite
 serviceClass = com.splunk.dbx2.DefaultDBX2JDBC
 jdbcDriverClass = org.sqlite.JDBC
 jdbcUrlFormat = jdbc:sqlite:<database>
 ui_default_catalog = $database$

db_connections.conf

[default]
useConnectionPool = true
maxConnLifetimeMillis = 1800000
maxWaitMillis = 30000
maxTotalConn = 8
fetch_size = 100

[VPN]
connection_type = sqlite
database = C:/Rest/DB.SQLite
host = localhost
identity = owner
jdbcUrlFormat = jdbc:sqlite:<database>
jdbcUseSSL = 0

Tried database = C:\Rest\DB.SQLite, jdbcUrlFormat = jdbc:sqlite://<database>, and database = C:\\Rest\\DB.SQLite.

0 Karma
Highlighted

Re: Monitor SQLite database file with Splunk DB Connect

Contributor

Seems the answer is creating an identity, a step I missed due to quick reading. Created it to match the identity name in db_connections.conf, with no password. The schema error is likely due to it being an unsupported and server-less DB.

http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Createandmanageidentities

Final configs are as follows:

db_connections.conf

[default]
useConnectionPool = true
maxConnLifetimeMillis = 1800000
maxWaitMillis = 30000
maxTotalConn = 8
fetch_size = 100

[VPN]
connection_type = sqlite
database = C:\Rest\DB.sqlite
host = localhost
identity = owner
jdbcUrlFormat = jdbc:sqlite:<database>
jdbcUseSSL = 0

dbconnectiontypes.conf

[sqlite]
 displayName = SQLite
 serviceClass = com.splunk.dbx2.DefaultDBX2JDBC
 jdbcDriverClass = org.sqlite.JDBC
 jdbcUrlFormat = jdbc:sqlite:<database>
 ui_default_catalog = $database$

View solution in original post

Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.