SPLUNK DB Connect - failed_to_get_the_conf OR ConfReadException

[sureshwalmart]

Hi

I am trying to push the data from Splunk to a database. I have installed SPLUNK DB Connect in a Search Cluster and configured connection and output (datalab). The data is not getting inserted to DB. I am observing the below errors in _internal logs.

2019-07-03 19:22:03.702 +0000 [dw-254 - PUT /api/outputs/ASDA_APAOOS_DAILY_Report] WARN c.s.dbx.server.dboutput.task.DbOutputTaskLoader - failed to read output ASDA_APAOOS_DAILY_Report com.splunk.dbx.exception.ConfReadException: Error(s) occur when reading ASDA_APAOOS_DAILY_Report.

2019-07-03 19:22:03.702 +0000 [dw-254 - PUT /api/outputs/ASDA_APAOOS_DAILY_Report] ERROR c.s.d.m.repository.DefaultConfigurationRepository - action=failed_to_get_the_conf reason=HTTP 401 -- call not properly authenticated

Has anyone faced this problem before? Please provide your suggestions for resolving this issue.

[harsmarvania57]

Hi,

I don't know which version of DB Connect are you using but DB Connect Output is not supported on Search Head Cluster https://docs.splunk.com/Documentation/DBX/3.1.4/DeployDBX/Distributeddeployment

DB Connect does not allow you to run scheduled inputs and outputs on a search head cluster from DB Connect 3.x.x. If you want to perform the scheduled tasks, you must run them on a heavy forwarder.

[sureshwalmart]

Thanks a lot @harsmarvania57 . I will try with heavy fowarder.