Splunk DB Connect: After creating a Rising Column DB input in my own app, why am I unable to see it?

[nialldonnelly]

I am wondering if anyone has seen this error in this configuration:
- OS: Windows 10
- Splunk: 6.5.0
- Splunk DB Connect: 2.3
- Oracle DB, via ojdbc driver.

I have two almost identical DBInputs: DBInput1=rising_column, DBInput2=batch_input. When I create these DB Inputs with app="Splunk DB Connect", they both work fine. But, I want them in my own app.

When I create the two Inputs again (identical in every way except app=MyAPP), DBInput2=batch_input works fine, but DBInput1=rising_column gives the HTTP error:

"Getting "HTTPError: HTTP 404 Not Found - could not find object id=mi_input://DBInput1"

On Linux, I would probably start with chmod/chown and make sure all is OK in the Splunk\etc\apps\MyApp folder. I'm using Windows 10 though, and although all the security settings for folders look fine when I check properties, I feel like I'm missing something.

I'm wondering, anyone else have/had a similar problem?
Is it a problem with the CherryPy web server and permissions?
Or should I be adding more configurations to my app, for example adding authorize.conf in the MyApp\local folder? (it just seems odd that batch_input works, but rising_column does not, hence not sure if this area is worth looking into).

Cheers,

N.

[nialldonnelly · Accepted solution]

It looks like this is working now, so will answer my own question for this thread. Whether this is the best answer, no idea, but it solved the problem I had.

1. If your app shares DB Inputs with the DB Connect App, make sure that user perms are added to your app, so that that the built-in DB Connect users have the necessary rights in your own app. I added these users to my app, whether they need read/write will depend on your app:
2. db_connect_admin

3. db_connect_user

4. In the end, I turned on SSL to avoid any scenarios whereby functions are dependent on REST API calls. If stuck, it's worth doing this to see if that helps. It did for me.

N.

[nialldonnelly]

A bit more on this, not completely solved yet, but a morning moment of doh!

As an internal server for testing, I had forgone the need for HTTPS. However, inside splunk-sdk-1.xxx.egg, the file binding.py uses these by default:
DEFAULT_HOST = "localhost"
DEFAULT_PORT = "8089"
DEFAULT_SCHEME = "https"

And of course, it needs SSL turned on to use DB Connect. I'd missed that originally. So I'm going through whether to change the fields in binding.py, or simply use SSL and reconfigure the system.

I've turned on debugging (or I think I have). I've followed the instructions for both Splunk and DB Connect, and Debugging works fine mostly. However, I cannot find the field that turns on debugging for .py files inside splunk-sdk-1.xxx.egg. There is one line inside binding.py - logging.debug("GET request to %s (body: %s)", path, repr(query)) - that it would be nice to see in the debug output. But changes to dbx_logging.conf don't seem to filter to this file.

I have followed http://docs.splunk.com/Documentation/DBX/2.0.5/DeployDBX/Troubleshooting wrt dbx_logging.conf, restarted Splunk, and see lots of DEBUG messages, but not that particular line.

Am I missing a setting?