All Apps and Add-ons

Monitoring SQLite DB through DB connect giving "null of stanza <stanza_name> does not exist"

davidoff96
Path Finder

I have been trying to monitor a SQLite database, and have been having nothing but problems. I managed to find some stanzas that apparently worked for other people, notably this one: https://community.splunk.com/t5/All-Apps-and-Add-ons/Monitor-SQLite-database-file-with-Splunk-DB-Con...

 

I am actually able to see the driver in the installed drivers tab, and I can see my stanza within possible connections when trying to test a query:

davidoff96_0-1734618947535.png

davidoff96_1-1734618972350.png

 

I used exactly what was in that previous question and that didn't work, and I tried several other changes, and currently have this:

db_connection_types.conf:

[sqlite]
displayName = SQLite
serviceClass = com.splunk.dbx2.DefaultDBX2JDBC
jdbcDriverClass = org.sqlite.JDBC
jdbcUrlFormat = jdbc:sqlite:<database>
ui_default_catalog = main
database = main
port = 443

db_connections.conf:

[incidents]
connection_type = sqlite
database = /opt/tece/pb_data/data.db
host = localhost
identity = owner
jdbcUrlFormat = jdbc:sqlite:<database>
jdbcUseSSL = 0

I am getting this error now:

davidoff96_2-1734619161505.png

 

I also see this in the logs:

2024-12-19 14:38:59.018 +0000 Trace-Id= [dw-36 - GET /api/inputs] INFO c.s.d.s.dbinput.task.DbInputCheckpointFileManager - action=init_checkpoint_file_manager working_directory=/opt/splunk/var/lib/splunk/modinputs/server/splunk_app_db_connect


2024-12-19 14:39:15.807 +0000 Trace-Id=6dac40b0-1bcc-4410-bc28-53d743136056 [dw-40 - GET /api/connections/incidents/status] WARN com.splunk.dbx.message.MessageEnum - action=initialize_resource_bundle_files error=Can't find bundle for base name Messages, locale en_US

I have tried 2 seperate SQLite drivers, the most up to date one, and the one specifically for the version of the database of SQLite that I am using.

Anyone have any ideas?

Labels (2)
0 Karma
Get Updates on the Splunk Community!

New This Month - Splunk Observability updates and improvements for faster ...

What’s New? This month, we’re delivering several enhancements across Splunk Observability Cloud for faster and ...

What's New in Splunk Cloud Platform 9.3.2411?

Hey Splunky People! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2411. This release ...

Buttercup Games: Further Dashboarding Techniques (Part 6)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...