All Apps and Add-ons

Splunk DB Connect 2.0.5: Why do I keep getting "Login failed..." trying to validate connection with MSSQL?

brooklynotss
Path Finder

Windows 2012 search head with Splunk Enterprise 6.3 and the latest DB Connect 2.0.5 installed.
It also has DBX 1.1.5 installed and that's working just fine. I'm trying to recreate my connections in v2.0.5 as recommended - Identities and Connections that is. I wasn't planning on copying over any of the .conf stanzas from the old into the new, but maybe that would be easier?

I have both the jtds-1.2.6.jar file and sqljdbc4.jar file (the latter dated 8-21-2015 if that helps/matters) copied into the ..Splunk\etc\apps\splunk_app_db_connect\bin\lib folder. I've tried using both the MS-SQL Server Using MS Generic Driver as well as "With Windows Authentication", even though I don't want to go that route as well as the MS-SQL Server Using jTDS Driver which I believe is how the v1.1.5 DB Connect is working...

Receiving this in the logs:

10/05/2015 19:05:29 [ERROR] [rh_connections.py] exception Validating connection with URL [jdbc:sqlserver://MySQLServername01.FQDN.com:1433;databaseName=TRACKIT10;selectMethod=cursor] failed: com.microsoft.sqlserver.jdbc.SQLServerException:com.microsoft.sqlserver.jdbc.SQLServerException: Login failed for user 'ACCOUNTTHATWORKS'. ClientConnectionId:eb63ef2f-5ef6-477a-9dd8-174e5d4b5120

Have also tried using domain\username format but same error.

I can connect to the same server and db using the same credentials via SQL Management Studio.

Any advice/tips appreciated.

spsrasru
Path Finder

are you running splunk service as domain account ?

0 Karma

brooklynotss
Path Finder

yes and just FYi - I gave up on this and am just using local SQL accounts now.

0 Karma

spsrasru
Path Finder

Upgrade your app to new version (2.0.6) OR Use SQL server authentication (local access) for 2.0.5 version.

There was a bug in 2.0.5 version where Microsoft SQL Server did not work in Windows Authentication mode.

http://docs.splunk.com/Documentation/DBX/2.0.6/ReleaseNotes/Releasenotes
2015-06-04 DBX-1694 Connecting to Microsoft SQL Server did not work in Windows Authentication mode.

0 Karma

brooklynotss
Path Finder

I'm using 2.0.6. Still no good. Works for local accounts, not domain accounts.

0 Karma

dbabanov
Path Finder
0 Karma

brooklynotss
Path Finder

yes, gone through all that.
Using FQDN for server name, not using Windows Auth (but tried it anyway), verified and re-verified the correct jar files are in the right place, confirmed and re-confirmed the SQL DB port number. Verified 2x that I can connect using SQL Mgmt Studio with the same credentials. Both DB Connect 1 and 2 are on the same server and the same connection works with DBX1 so I know it's not a firewall or routing issue. The error says "Login failed" so makes me think something else is going on here. Given lack of replies here, maybe I'll remove DBX2 and start from scratch in the future. For now, sticking with DBX1 since it works fine for the most part.

0 Karma

jsmith_splunk
Splunk Employee
Splunk Employee

I'm having the same issue with DB connect 2 trying to access an ePo database.
I know the user/pass is correct, the 1433 port is open, host is set to an IP so it's not an fqdn issue and I keep getting a login failed for user 'user'. ClientConnectionID.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...