Splunk DB Connect: After deploying the app to the search head cluster, why am I unable to access the app on a search head?

[ben_august]

I have installed the Splunk DB Connect app (v 2.3.1, then upgraded to 2.4.0) to a our Search Head Cluster (SHC) deployer and it works wonderfully. I set up identities, connections, inputs and roles/permissions for them. But when I deploy the pre-configured app to the SHC, the roles/permissions do not seem to work. I get "Loading" on the right-hand panel when I access the Splunk DB Connect app on a search head, and when I go to view my inputs, I get:

The specified database input foo_input has a missing connection foo_connection. Please choose another option from the menu on the left to continue

I can see that all of the configuration has been deployed to the SHC. The roles and permissions all look OK. The search head says the RPC server is running. What am I missing?

[vasanthmss · Accepted solution]

please check the below steps to debug further,

1. check your connection and entity have access to app level / global?
2. Are you running as administrator? if not please add the roles the db_connect_user / db_connect_admin
3. Check the per-configured apps have the correct permission to dbxquery / any functionality provided by db_connect app,

Please post some further logs to assist further.

[ben_august]

In the end, the trick is to

• grant app permissions to the various roles you want to access the app
• give those roles permissions to the identities/connections
• add those roles to db_connect_admin and/or db_connect_user

I thought the first two would be sufficient without introducing the extra roles. Alas, the third item is necessary also.