Issue:Splunk DB connect not loading data using Splunk_TA mcafee add on
DB connect version:3.1
it connects to DB but no details are pulled from configured table
did searched index=mcafee sourcetype=mcafee:epo but no data ...how to resolve the same..
we did test the DB connection is fine , also most of the queries are giving results but older results like of nov 2019 not of feb 2020
check point value is blank
also |tstats count where index=mcafee by sourcetype when i search this using normal search no results
also using the DB connect app no results
what needs to be checked else to resolve this issue
how can i check if there is a table permission issue , user says queries used to run and fetch the data automatically
connection is mcafee_epo_5_db
table name is "eP04_VAVSRV01"
Are you searching within the context of the dbconnect app, or from the more general search app context? Context makes a big difference when it comes to sourcetypes. If the latter, you'll have to update props.conf in the search app dir to include the sourcetype you're referencing.
One easy method to verify sourcetypes within a index is to use the following:
|tstats count where index=mcafee by sourcetype
Have you tested your query in DB Connect to make sure it is correct?
If it doesn't return any results then you either have an issue with the query, permissions to the table, or the connection to the db.
yes i have tested the connection to be fine , but for few tables the query is not fecthing any results for few tables it is not giving the latest details like for the last week also for last week we get no data
how can we check if the data is getting ingested
I would recommend you start by looking through your _internal logs for the host you have running DBConnect. Look for any specific errors related to your query or even the credentials you might be using to connect.