All Apps and Add-ons

Splunk DB Connect MSSQL DB Input does not work

gauravmishra15
Path Finder

Hi All,

I am facing an issue with Splunk DB connect. I was able to create a Database connection (MSSQL) and add a Database input. The Database connection works but Database input (DBMon Tail) is not able to fetch the data from SQL. Here is my inputs.conf file -


[script://.\bin\jbridge_server.py]
disabled = 0

[batch://$SPLUNK_HOME\var\spool\dbmon*.dbmonevt]
crcSalt =
disabled = 0
move_policy = sinkhole
sourcetype = dbmon:spool

[dbmon-tail://DB_MyUAT/Table_LOG]
host = localhost
index = mssql
interval = 1h
output.format = mkv
output.timestamp = 1
output.timestamp.column = List_CREATE_DATE
output.timestamp.format = "yyyy-MM-dd HH:mm:ss.SSS"
query = SELECT * FROM [DB_MyUAT].[Sch_UAT].[Table_LOG] {{WHERE $rising_column$ > ?}}
sourcetype = Table_LOG
tail.rising.column = List_CREATE_DATE

table = Table_LOG

I did not find anything wrong in the DB side, I am able to run same query in DB using same account. I am not sure if I missed anything. Please suggest.

0 Karma
1 Solution

gauravmishra15
Path Finder

All,

This issue was due to permission issue. The ID through which DBmon was created, did not have permission to write in the index. Issue was resolved by adding correct permissions.

View solution in original post

0 Karma

gauravmishra15
Path Finder

All,

This issue was due to permission issue. The ID through which DBmon was created, did not have permission to write in the index. Issue was resolved by adding correct permissions.

0 Karma
Get Updates on the Splunk Community!

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...