Brand new CentOS 7 system with Splunk 7, DBConnect 3.1.1 and Java JDK 1.8.0_144. Splunk starts fine, DBconnect installs fine, but when I go to access the app, I just get the message Unable to initialize modular input "server" defined inside the app "splunk_app_db_connect": Introspecting scheme=server: script running failed (exited with code 127).
I can't even access the controls to configure the DBconnect app, I just get the little circling spokes with the splunk controls at the top of the window.
I've tried wiping Splunk and reinstalling to see if it was an issue with the Java install, but same results. Has anyone else run into this with new the version of Splunk?
I'm uncertain as to what the underlying cause might be, I wiped the system this morning and installed with Ubuntu 16.04LTS. Fresh install of Splunk 7, installed the DBConnect app, and exact same behavior. To those suggesting modification to the firewall, it's not a firewall issue as I can connect to the Splunk web frontend and see the same results.
I was able to install successfully this environment:
- CentOS Linux release 7.0.1406 (Core)
- JDK build 1.8.0_144-b01
- Splunk 7.0.0 build c8a78efdd40f
- DB Connect 3.1.1 build 34
The only thing to mention is to open the 8000 port:
firewall-cmd --zone=public --add-port=8000/tcp
I've passed for the same problem and I resolved this issue enabling the port (9998 or any that you want) in the firewall in my CentOS 7.
firewall-cmd --zone=public --add-port=9998/tcp --permanent
I hope help you.
Can you try to run DB Connect installation's health checks, please? To run them you need to go to your monitoring console > Health Check and then select the app DB Connect. You can also use this URL http://your_host:8000/en-US/app/splunk_monitoring_console/monitoringconsole_check
Can you try to visit the page mentioned earlier by accessing the following URL http://your_host:8000/en-US/app/splunk_monitoring_console/monitoringconsole_check ?
Can you have a look on splunkd.log? You need to search for the string "server.sh" in this file to find relevant logs about your issue.
From splunkd.log: 10-09-2017 14:04:32.774 -0400 WARN ExecProcessor - message from "/opt/splunk/etc/apps/splunk_app_db_connect/linux_x86_64/bin/server.sh" com.splunk.modularinput.MalformedDataException: Events must have at least the data field set to be written to XML.
10-09-2017 14:04:32.774 -0400 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/splunk_app_db_connect/linux_x86_64/bin/server.sh" com.splunk.modularinput.Event.writeTo(Event.java:65)\com.splunk.modularinput.EventWriter.writeEvent(EventWriter.java:134)\com.splunk.dbx.server.bootstrap.TaskServerStart.streamEvents(TaskServerStart.java:76)\com.splunk.modularinput.Script.run(Script.java:66)\com.splunk.modularinput.Script.run(Script.java:44)\com.splunk.dbx.server.bootstrap.TaskServerStart.main(TaskServerStart.java:149)\
Visiting the URL just shows the word LOADING... with no controls or inputs available