No compatible drivers were found in the 'drivers' directory.

[tshah5]

I have installed splunk dbx forwarder in 1 of my VM.

Now when I am trying to create connection with MongoDB, I am getting this error (Our MongoDB uses certs and key for authentication and not username and password):

No suitable driver found for jdbc:mongo://<host>:<port>/?authMechanism=MONGODB-X509&authSource=$external&tls=true&tlsCertificateKeyFile=<path to cert key pair>&tlsCAFile=<path to ca cert>

Diagnosis:
No compatible drivers were found in the 'drivers' directory.

Possible resolution:
Copy the appropriate JDBC driver for the database you are connecting to in the 'drivers' directory.

Splunk DBX Add-on for MongoDB : 1.2.0

List of Mongo drivers tried: 

mongodb-driver-core-4.10.2.jar 
mongojdbc4.8.3.jar 
splunk-mongodb-jdbc-1.2.0.jar
mongodb-driver-sync-4.10.2.jar 
ojdbc8.jar         
UnityJDBC_Trial_Install.jar
mongodb-jdbc-2.2.2-all.jar  
mongo-java-driver-3.12.14.jar  
mongodb-driver-core-5.2.1.jar
mongodb-driver-sync-5.2.1.jar

But getting the same version each time.

Splunk_dbx forwarder version:  Splunk 6.4.0
Mongo db version : 7.0.14

----------------------------------------------------------
This is the db_connection_types.conf:

[mongo]

displayName = MongoDB

jdbcDriverClass = com.mongodb.jdbc.MongoDriver

ServiceClass = com.mongodb.jdbc.MongoDriveri

jdbcUrlFormat = jdbc:mongo://<host:port>,<host:port>,<host:port>/?authMechanism=MONGODB-X509&authSource=$external&tls=true&tlsCAFile=<path to ca file>&tlsCertificateKeyFile=<path to cert and key file>

useConnectionPool = false

port = 10924

ssl = true

sslMode = requireSSL

sslCertificatePath = <path to file>

sslCertificateKeyPath = <path to file>

sslAllowInvalidHostnames = false

authSource = $external

tlsCipherSuite = "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"

[livehybrid]

Hi @tshah5 

I noticed you have ServiceClass=com.mongodb.jdbc.MongoDriveri

Is that a typo "i" on the end of that? 

Let us know if you still experience the issue after updating that.

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

[tshah5]

Hey Will,

Still the exact same error. DO you have a list or checklist of things I should check?

Any suggestions on which version of driver should I try?

Thanks,
Tanvi

[livehybrid]

Hi @tshah5 

Here are some considerations

• Splunk Version: You're on Splunk 6.4? That is pretty old now and well out of support, is there something preventing you using a newer version? Im not too sure if this will cause a mismatch in version compatibility between Mongo/DBX/Splunk.
  

• Driver Type: The key is to use the correct type of JDBC driver for MongoDB and your authentication method (X.509). The drivers you've listed are a mix of different types. You need a driver specifically designed for MongoDB that supports X.509 authentication. Based on the connection string you are trying to use, that would be mongodb-jdbc.

• JDBC Driver Version: Ensure the mongodb-jdbc driver you're using is compatible with both your MongoDB version (7.0.14) and your Splunk DB Connect version (especially Splunk 6.4). MongoDB JDBC driver is used for MongoDB 5 or newer and Splunk DBX version 3.5.0 and higher. You may need to use Mongo Java Driver based on the Mongo Db version.

• Location: You need to place the JDBC driver in the correct directory. In your case, it's likely "$SPLUNK_HOME/etc/apps/splunk_app_db_connect/drivers". Double-check this path, as a slight variation can cause the driver to be missed.

• Permissions: Ensure the Splunk user (usually splunk) has read permissions to the JAR files in the drivers directory.

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will